CVE-2026-91814

Executive Summary

CVE-2026-91814 is a signature validation flaw (CWE-347: Improper Verification of Cryptographic Signature) in Foxit PDF Editor and Foxit PDF Reader affecting the handling of incrementally updated PDF documents. When a PDF is modified via incremental update, changes to visible document content may fail to invalidate the existing digital signature, meaning an attacker can alter what a reader sees while the document still presents as validly signed.

The vulnerability has a CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N — the dominant impact is to integrity (I:H), requiring user interaction to open a crafted document and a non-trivial attack precondition (AC:H). No public proof-of-concept, exploit code, or Nuclei template exists, EPSS has not scored the CVE, and it is not listed in CISA KEV.

Technical Analysis

The defect resides in the verification logic Foxit applies to PDFs that use incremental updates — the standard PDF mechanism by which a document is amended by appending new objects and a new cross-reference section rather than rewriting the whole file. This design is intrinsic to PDF and is routinely used for annotation, form fill, and digital signing workflows.

A digital signature in PDF is normally computed over a defined byte range of the file. The security question is which byte range is covered and whether any content rendered to the user falls outside that signed range. For incrementally updated documents, a signature may be applied to an earlier revision, with later revisions appended afterward. If the verifier does not correctly bind the signature to the final visible revision, content added or changed in a subsequent incremental update can be displayed to the user without causing the signature to fail validation.

CVE-2026-91814 describes exactly this failure mode: changes to visible document content may not invalidate the existing signature. The result is a signature-presentation integrity gap — the signature validates against the portion of the file it originally covered, while the rendered content shown to the user reflects later, unsigned modifications. Because the product continues to present the document as validly signed, the trust signal the user relies on is decoupled from the content they actually see.

Relevant weakness: CWE-347 (Improper Verification of Cryptographic Signature). The flaw is in the validation/handling path, not in the cryptographic primitives themselves.

Attack surface (derived from the description): the PDF parsing and signature-verification pipeline of Foxit PDF Editor/Reader, exercised whenever a user opens a signed PDF that has been modified through incremental updates. No specific functions, API calls, parameters, or file paths are disclosed in the available description, and no affected version ranges have been published by the vendor or NVD at the time of writing. Insufficient technical detail is available to specify the exact code path or the precise byte-range logic that fails.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred strictly from the vulnerability class (signature validation bypass via incremental update) and the description supplied. No specific function names, endpoints, or parameters are invented because none are disclosed.

1) Reconnaissance / target identification. The adversary identifies a context where a signed PDF carries authority — contracts, invoices, purchase orders, compliance attestations, legal filings, or approval memos. The critical precondition is that the intended victim relies on the visual "signature valid" indicator rather than independently re-verifying the document hash or byte range.

2) Triggering the flaw class. The attacker obtains a legitimately signed PDF (or has one signed by a party whose signature will remain intact). Using any tool capable of authoring incremental updates, the attacker appends a revision that alters visible content — for example a payment amount, a beneficiary account, a date, a name, or a set of terms — and leaves the original signature object in place. Per the NVD description, the altered visible content may not invalidate the existing signature.

3) Delivery / execution method (vulnerability-class level). The crafted document is delivered through any normal file channel: email attachment, shared drive, ticketing system, e-signature workflow, or web download. The trigger requires user interaction (UI:R) — the victim must open the document in Foxit PDF Editor or Foxit PDF Reader. No special privileges (PR:N) and no prior authentication are required on the victim side.

4) Post-exploitation impact. The victim sees content that differs from what was originally signed while the application still indicates a valid signature. Consequences are integrity- and trust-oriented (integrity I:H): fraudulent approvals, altered financial terms, falsified attestations, and reputation damage to the signature-verification workflow itself. There is no confidentiality impact (C:N) and no availability impact (A:N) per the CVSS vector — this is not a code-execution or data-exfiltration bug based on the information provided.

Impact Assessment

• Scope: Unchanged (S:U) — the impact is confined to the vulnerable Foxit component and the trust semantics of the affected document, not a pivot to other security authorities.
• Confidentiality: None (C:N) — the flaw does not disclose data.
• Integrity: High (I:H) — the core impact: displayed content can diverge from signed content while appearing genuine.
• Availability: None (A:N).
• Attack Vector: Network (AV:N) — the malicious document is delivered remotely.
• Attack Complexity: High (AC:H) — crafting a PDF with a valid signature over one revision and altered visible content in an incremental update is non-trivial and requires document-format expertise.
• Privileges Required: None (PR:N).
• User Interaction: Required (UI:R) — the victim must open the file in Foxit.

Blast radius: Any organization that accepts digitally signed PDFs as authoritative — legal, finance, procurement, HR, government, and regulated industries — is exposed wherever Foxit PDF Editor/Reader is the verification tool of record. The business impact is the erosion of non-repudiation: a signature that "validates" no longer guarantees that the visible content is the signed content. Because the exploit is a malformed-but-plausible document rather than a network attack, perimeter controls are largely irrelevant, and downstream arbitration (e.g., disputes over what was actually agreed) becomes difficult.

Risk is moderated by AC:H, UI:R, and the absence of known exploitation, but the strategic value to fraud and business-email-compromise actors is high because it directly attacks trust in signed documents.

Detection Guidance

Detection must focus on document-level anomalies (multiple incremental revisions around a signature, objects appended after the signed byte range) and on file-delivery events carrying signed PDFs. Network and endpoint telemetry for this class is limited; the rules below target the observable signals.

Sigma Rule

title: Foxit PDF Signed Document Opened From Unsolicited/External Source (CVE-2026-91814)
id: 8f1c2a44-7b6e-4a9d-9c31-8a0f5cve91814
status: experimental
description: Detects a signed PDF being opened by Foxit PDF Reader/Editor when delivered from external or untrusted sources, relevant to signature validation bypass via incremental update (CVE-2026-91814).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91814
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1553.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - '\FoxitPDFReader.exe'
        - '\FoxitPDFEditor.exe'
        - '\Foxit Reader.exe'
  selection_parent:
    ParentImage|endswith:
      - '\outlook.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  selection_cmd:
    CommandLine|contains:
      - '.pdf'
      - 'Temp'
      - 'Downloads'
  condition: selection_img and selection_parent and selection_cmd
falsepositives:
  - Legitimate signed PDFs opened from email or browser
level: low

YARA Rule

rule PDF_Foxit_Signed_Incremental_Update_Anomaly_CVE_2026_91814
{
    meta:
        author = "valtersit.com"
        description = "Detects PDFs with a signature field combined with multiple incremental updates (multiple %%EOF markers), indicative of signature-invalidation bypass risk (CVE-2026-91814)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91814"
        date = "2026-01-01"

    strings:
        $hdr = "%PDF-"
        $eof = "%%EOF"
        $sig = "/Type /Sig"
        $sig2 = "/Type/Sig"
        $sigfield = "/Sig"
        $byterange = "/ByteRange"
        $subfilter = "/SubFilter"
        $acro = "/AcroForm"

    condition:
        $hdr at 0 and
        filesize < 60MB and
        $byterange and
        ($sig or $sig2 or $sigfield) and
        #eof >= 2
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91814 Possible Foxit PDF Signed Incremental-Update Content Spoofing - PDF Download"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"/ByteRange"; content:"/SubFilter"; content:"%%EOF"; distance:0; within:2000000; fileext:"pdf"; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2026-91814; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91814; classtype:attempted-user; sid:202691814; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "Foxit Reader.exe") and
  process.parent.name : ("outlook.exe", "chrome.exe", "msedge.exe", "firefox.exe") and
  process.args : "*.pdf"

Splunk SPL Query

index=endpoint (Image="*\\FoxitPDFReader.exe" OR Image="*\\FoxitPDFEditor.exe")
    (CommandLine="*.pdf" OR CommandLine="*.PDF")
    (ParentImage="*\\outlook.exe" OR ParentImage="*\\chrome.exe" OR ParentImage="*\\msedge.exe")
| stats count min(_time) as firstSeen max(_time) as lastSeen by host, User, ParentImage, CommandLine
| where count >= 1
| sort - lastSeen

Wazuh OSSEC Rule

<group name="foxit,pdf,cve-2026-91814,">
  <rule id="100918" level="6">
    <if_sid>59200</if_sid>
    <field name="win.eventdata.image">(?i)Foxit(PDFReader|PDFEditor|Reader)\.exe</field>
    <field name="win.eventdata.parentImage">(?i)(outlook|chrome|msedge|firefox)\.exe</field>
    <field name="win.eventdata.commandLine">(?i)\.pdf</field>
    <description>CVE-2026-91814: Foxit PDF Reader/Editor opened a PDF from an external parent process - possible signed-document integrity bypass</description>
    <mitre>
      <id>T1553.002</id>
    </mitre>
    <group>pdf_security,cve_2026_91814,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, no workaround, and no affected version ranges have been published. Treat all Foxit PDF Editor/Reader signature-verification workflows as untrusted for authoritative decisions until a fix is available.

1) Immediate mitigations

• Do not treat the in-application "signature valid" indicator as sole proof of content authenticity. Independently verify signed PDFs using a second, unrelated verifier and compare the authenticated byte range against the rendered content.
• Restrict automatic opening of PDF attachments from external senders; route signed PDFs that carry authority (contracts, invoices, approvals) through a manual review step that compares the signed revision with the visible content.
• For high-value documents, prefer out-of-band confirmation of amounts, account numbers, and terms rather than relying on the document's own signature presentation.

2) Patch / upgrade steps

• Monitor Foxit's official security bulletins and the NVD entry for CVE-2026-91814. No patched version is identified at this time; do not assume any currently available version resolves this issue.
• When a vendor fix is released, update Foxit PDF Editor and Foxit PDF Reader to the fixed build on all endpoints, and confirm the change in a controlled test before broad rollout.
• Track the CVE in your vulnerability management system with a status of "awaiting vendor patch."

3) Long-term hardening

• Enforce standards-compliant digital signature validation (e.g., PAdES/LTV-aware validation) that binds the signature to the final revision and rejects content outside the signed byte range.
• Where feasible, require signatures applied after all content changes, and use document-management systems that validate signatures server-side rather than trusting the client viewer.
• Add controls that detect PDFs containing multiple incremental updates around a signature field, and flag them for review.
• User awareness: train finance, legal, and procurement staff that a "signed" banner from a viewer is not proof of content integrity.

References

• NVD — CVE-2026-91814: https://nvd.nist.gov/vuln/detail/CVE-2026-91814 (primary source; NVD description used for this report)
• CWE-347 — Improper Verification of Cryptographic Signature: https://cwe.mitre.org/data/definitions/347.html
• MITRE ATT&CK T1553.002 — Subvert Trust Controls: Code Signing: https://attack.mitre.org/techniques/T1553/002/
• Foxit Security Bulletins (vendor advisory channel — monitor for CVE-2026-91814 fix): https://www.foxit.com/support/security-bulletins.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91814 not listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploitation status: No public PoC, no exploit code, no Nuclei template, no EPSS score, and no CISA KEV listing. No threat actor campaign or in-the-wild exploitation evidence is associated with CVE-2026-91814 at the time of writing. All exploitation detail in this report is inferred from the vulnerability class described by NVD.