CVE-2026-91815

Executive Summary

CVE-2026-91815 is a heap-based out-of-bounds write (CWE-787) in Foxit PDF Editor and Foxit PDF Reader, caused by insufficient verification of JPEG2000 image metadata embedded inside a PDF file. A crafted PDF that contains a malicious JPEG2000 (JP2/J2K) image stream can corrupt heap memory during decoding, crashing the application and creating a pathway to arbitrary code execution in the context of the user who opens the file. The vulnerability is local, requires user interaction (opening a malicious document), and carries a CVSS 3.1 base score of 7.8 (High) with High confidentiality, integrity, and availability impact — a classic document-based client-side attack relevant to any organization whose users open externally sourced PDF files.

Technical Analysis

Foxit PDF Editor/Reader parses PDF container objects and delegates embedded image streams to decoders based on the stream filter. For JPEG2000 content, the decoder reads image metadata — dimensions, tile geometry, component counts, bit depths, and coding-style parameters — from the JP2/J2K codestream and uses those values to size and index heap-allocated buffers. Per the NVD description, Foxit "does not perform sufficient verification of the JPEG2000 image metadata," meaning the decoder trusts attacker-controlled metadata fields without adequate bounds or consistency validation before writing decoded data.

The result is a heap-based out-of-bounds write (CWE-787): the decoder computes a buffer size from unvalidated metadata while writes occur using a mismatched size, count, or offset derived from the same or related fields. Because the write occurs during normal decode of a document the user explicitly opens, it is reachable with no authentication and no prior access to the target system — only the ability to deliver a file.

Attack surface and preconditions:

• Attack vector: local (AV:L). The malicious file must be delivered to and opened by the target user; the vulnerability itself is not remotely reachable without a delivery mechanism plus user action.
• User interaction: required (UI:R) — the victim must open the PDF.
• Privileges: none required (PR:N), but code executes with the privileges of the Foxit process, i.e., the opening user's context.
• Scope: unchanged (S:U) — impact is confined to the Foxit process and the user's session.

Scope of the defect: heap corruption during JPEG2000 decoding. The description confirms the potential for both program crash (availability impact) and arbitrary code execution (confidentiality and integrity impact). No specific function names, class names, internal offsets, or memory allocator behaviors are disclosed in the available data, so no code-level identifiers are asserted here.

Notable intelligence gaps: the CNA title is empty, the vendor is listed as "Unknown/Unknown" at the record level (the description attributes the product to Foxit), no affected version range is published, and no CWE-beyond-CWE-787 mapping, root-cause advisory, or binary diff is available. All analysis above is derived strictly from the NVD description and the assigned CVSS vector.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is known for CVE-2026-91815. The attack chain below is inferred at the vulnerability-class level from the NVD description and is not drawn from observed exploit code.

1. Reconnaissance and target identification. An attacker identifies organizations or individuals known to use Foxit PDF Editor/Reader as their PDF handler on Windows or other supported endpoints. Mail gateway configuration, file-sharing links, and user habits (opening PDFs from unknown senders) determine feasibility. Attackers may also target engineering, legal, finance, and government users who routinely exchange PDFs.

2. Triggering the flaw class. The attacker crafts a PDF containing an embedded JPEG2000 image stream whose metadata is malformed or internally inconsistent — for example, dimensions, component counts, tile parameters, or bit-depth values that do not agree with the actual codestream data. The PDF is delivered via email attachment, web download, or shared storage. When the victim opens the document, Foxit invokes its JPEG2000 decoder; because metadata verification is insufficient, the decoder allocates a heap buffer based on the unvalidated metadata and then writes decoded data past the buffer boundary. No further user action beyond opening the file is required to reach the corrupting write.

3. Payload and execution method (vulnerability-class level). Heap out-of-bounds writes of this class are exploited by shaping the heap so that the corrupted object is adjacent to a function pointer, object vtable, or length field that the process subsequently uses. The attacker's goal is to convert the write into control-flow hijack or to reposition data used by a later operation, ultimately executing attacker-supplied code inside the Foxit process. Because no exploit code or root-cause write-up is available, the precise layout primitives, grooming technique, and overwrite target cannot be stated and are not asserted here. In the absence of a reliable code-execution primitive, the same crafted document still yields a reliably corrupting write and therefore a crash (denial of service).

4. Post-exploitation impact. Successful exploitation grants code execution with the privileges of the user who opened the PDF. From there, typical post-exploitation follows general client-side compromise patterns: staging a second-stage payload, persistence in the user's profile, credential and document harvesting, and lateral movement via the user's authenticated sessions. Failure to achieve code execution still yields an application crash that can disrupt document workflows.

Impact Assessment

• Confidentiality: High (C:H). Code execution in the user's context exposes documents, credentials, and session data available to that user.
• Integrity: High (I:H). An attacker with code execution can modify files and data the user can access.
• Availability: High (A:H). The out-of-bounds write is directly reachable and can crash the application; exploitation attempts that fail to gain control still cause process termination.
• Attack vector Local (AV:L), Attack complexity Low (AC:L), Privileges Required None (PR:N), User Interaction Required (UI:R), Scope Unchanged (S:U). Base score 7.8 — High.

Blast radius is bounded by the per-user session (scope unchanged), but the population of affected systems is potentially very large: any endpoint where Foxit PDF Editor or Reader is the primary or secondary PDF handler. Because the record provides no affected version range, remediation cannot be scoped by version and every unpatched Foxit installation on which JPEG2000 decoding is enabled must be treated as potentially vulnerable. In high-value phishing campaigns — the natural delivery model for document-borne client bugs — a single crafted PDF sent to many recipients can produce multiple compromises from one authoring effort. EPSS has not yet been scored by FIRST.org, so no exploitation-likelihood estimate is available; CISA KEV does not list this CVE, and there is no evidence of in-the-wild exploitation at the time of writing. Attackers who learn of the flaw (once an advisory is published) could adopt it quickly, as PDF-borne exploits are a well-established initial-access technique.

Detection Guidance

Sigma Rule

title: Foxit PDF Reader or Editor Spawning Child Process from Document Context
id: 8f3c1a2e-5b7d-4c9a-9e21-3d6f0a7b4c15
status: experimental
description: >
  Detects Foxit PDF Editor/Reader launching a child process (shell, script host,
  or LOLBin) after opening a document. Relevant to CVE-2026-91815 where a crafted
  PDF with malicious JPEG2000 metadata can corrupt heap memory and may lead to
  arbitrary code execution in the user's context.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91815
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1203
  - attack.execution
  - cve.2026.91815
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
fields:
  - ParentImage
  - Image
  - CommandLine
  - User
falsepositives:
  - Legitimate signed Foxit plug-ins invoking script hosts (rare; validate signer)
  - Enterprise PDF workflow tools that chain Foxit with automation binaries
level: high

YARA Rule

rule EXPL_CVE_2026_91815_Foxit_JPEG2000_Heap_OOB
{
    meta:
        description = "Flags PDF documents containing JPEG2000 image streams, the attack surface for CVE-2026-91815 (Foxit PDF Editor/Reader heap out-of-bounds write during JPEG2000 metadata handling)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91815"
        cve = "CVE-2026-91815"
        date = "2026-01-01"
        severity = "high"

    strings:
        $pdf_magic = "%PDF-"
        $jp2_sig    = { 00 00 00 0C 6A 50 20 20 0D 0A 87 0A }
        $jpx_sig    = { 00 00 00 0C 6A 50 58 20 0D 0A 87 0A }
        $j2k_codestream = { FF 4F FF 51 }
        $jp2_cdef   = "cdef"
        $jp2_ihdr   = "ihdr"
        $jp2_jp2h   = "jp2h"
        $filter_jpx = "JPXDecode"
        $filter_jp2 = "/JPX"

    condition:
        $pdf_magic at 0 and
        (
            ($jp2_sig or $jpx_sig) or
            ($j2k_codestream in (0..filesize)) or
            ($jp2_ihdr or $jp2_jp2h or $jp2_cdef) or
            ($filter_jpx or $filter_jp2)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"EXPLOIT CVE-2026-91815 Foxit PDF JPEG2000 PDF File Download (Possible Heap OOB Trigger)"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"JPXDecode"; nocase; distance:0; content:"FF4FFF51"; nocase; distance:0; filestore; sid:9001815; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_91815, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, tag Exploit_Attempt; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91815;)

This rule fires on PDF files delivered over HTTP that reference the JPEG2000 decoder filter and embed a J2K codestream marker. It detects the delivery mechanism for a document-borne exploit of CVE-2026-91815; it does not confirm exploitation. Network metadata, TLS inspection posture, and file-size boundaries affect coverage. A companion rule should be deployed for SMTP and file-transfer protocols carrying PDF attachments.

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitReader.exe") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
                   "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe",
                   "certutil.exe", "bitsadmin.exe")

Deploy as an EQL rule in Elastic Security with a 5-minute look-back. Tune by adding process.parent.code_signature.status checks and by allowing known signed plug-in chains. Escalate to alert severity when the parent Foxit process was launched directly from an email client attachment path or browser download directory.

Splunk SPL Query

index=windows (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
(EventID=1 OR EventCode=4688)
| eval ParentProc=lower(coalesce(ParentImage, ParentProcessName, parent_process_name))
| eval ChildProc=lower(coalesce(Image, NewProcessName, process_name))
| where (like(ParentProc, "%foxitpdfreader.exe") OR like(ParentProc, "%foxitpdfeditor.exe") OR like(ParentProc, "%foxitreader.exe"))
    AND (like(ChildProc, "%\\cmd.exe") OR like(ChildProc, "%\\powershell.exe")
      OR like(ChildProc, "%\\wscript.exe") OR like(ChildProc, "%\\cscript.exe")
      OR like(ChildProc, "%\\mshta.exe") OR like(ChildProc, "%\\rundll32.exe")
      OR like(ChildProc, "%\\regsvr32.exe") OR like(ChildProc, "%\\certutil.exe"))
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines by host, User, ParentProc, ChildProc
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Complement with a file-arrival hunt: index any PDF received by email or download (index=email OR index=proxy) and correlate filenames with subsequent Foxit processes within 15 minutes, using transaction on host and User.

Wazuh OSSEC Rule

<group name="windows,sysmon,cve-2026-91815,">
  <rule id="100815" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">(?i)FoxitPDF(Reader|Editor)\.exe$</field>
    <field name="win.eventdata.image">(?i)\\(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil)\.exe$</field>
    <description>CVE-2026-91815: Foxit PDF Editor/Reader spawned a command interpreter or LOLBin — possible exploitation of JPEG2000 heap out-of-bounds write.</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>exploit_attempt,pdf_client_abuse,</group>
  </rule>

  <rule id="100816" level="10">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">(?i)FoxitPDF(Reader|Editor)\.exe$</field>
    <field name="win.eventdata.image">(?i)\\(excel|winword|outlook|wscript|mshta)\.exe$</field>
    <description>CVE-2026-91815: Foxit PDF Editor/Reader spawned an unexpected application — investigate document origin and parent PDF hash.</description>
    <group>exploit_attempt,pdf_client_abuse,</group>
  </rule>
</group>

Rule 100815 depends on Sysmon Event ID 1 (if_sid 61603) being forwarded to the Wazuh manager. Adjust the if_sid to match the local Sysmon rule tree. Fields parentImage and image must be present in the decoded event JSON.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There is no vendor fix, no workaround, and no affected-version range in the supplied intelligence. The following guidance is version-agnostic and should be reviewed as soon as Foxit publishes an advisory for CVE-2026-91815.

Immediate mitigations (hours):

1. Restrict or disable JPEG2000/JPX decoding in Foxit where policy permits. If the product exposes a preference, plug-in, or configuration toggle for JPX/JPEG2000 rendering, disable it and validate that embedded JPX images are no longer decoded. Where no such control exists, treat this as unavailable and rely on the controls below.
2. Harden mail gateways and web proxies: strip, quarantine, or sandbox inbound PDF attachments from external senders; block PDFs from untrusted sources at the perimeter and detonate them in an isolated sandbox before release.
3. Reduce the attack surface at the endpoint: remove Foxit as the default PDF handler where an alternative hardened viewer is available for the relevant user population, or route PDF opening through an isolated browser or virtualized viewer.
4. Enable application-level exploit mitigations on endpoints where feasible (e.g., Windows Defender Exploit Guard / Attack Surface Reduction, ACG, and CFG) to blunt heap-corruption exploitation.
5. Monitor for Foxit process crashes (Windows Error Reporting / Application event log Event ID 1000) preceded by the opening of an externally sourced PDF; treat clusters of these as possible malicious documents.

Patch and upgrade steps (when a fix is published):

1. Subscribe to the Foxit security advisories and PSIRT feed; when an advisory addressing this CVE is released, map the fixed build numbers to your installed versions.
2. Stage the update in a pilot ring, verify that both the fixed version and the JPEG2000 decoder are active, then deploy broadly through your software deployment tooling.
3. Because no affected-version range is published, assume all currently deployed Foxit PDF Editor/Reader builds are potentially vulnerable until the vendor states otherwise. Prioritize updates for users in high-risk roles (executives, finance, legal, engineering, IT administrators).
4. After patching, keep the perimeter controls in place — they address the delivery stage for any future document-decoder vulnerability.

Long-term hardening:

1. Adopt a document-security architecture that detonates all externally sourced PDFs in a sandbox or converts them to flattened, non-executable formats before users open them.
2. Inventory and maintain current versions of all PDF readers and document viewers per endpoint, with a defined patch SLA for client-side parsing software.
3. Enforce least privilege on endpoints; code execution in a standard user context is materially less damaging than in an administrative one.
4. Instrument endpoint telemetry (process creation with parent-child lineage, WER crash records, file-write telemetry) to detect document-borne exploits across all viewers, not just Foxit.
5. Track this CVE for EPSS scoring and KEV inclusion; escalate priority immediately if either changes.

References

1. NVD — CVE-2026-91815: https://nvd.nist.gov/vuln/detail/CVE-2026-91815
2. CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
3. MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
4. FIRST EPSS (not yet scored at time of writing; recheck): https://api.first.org/data/v1/epss?cve=CVE-2026-91815
5. CISA Known Exploited Vulnerabilities Catalog (CVE not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor and in-the-wild evidence: none available. No public PoC, no exploit code, no Nuclei template, no CISA KEV entry, and no EPSS score are associated with CVE-2026-91815 in the supplied intelligence. The exploitation chain described in this report is inferred from the vulnerability class (CWE-787, document-borne client-side heap corruption) and from the NVD description alone.