CVE-2026-91816

Executive Summary

CVE-2026-91816 is a use-after-free vulnerability (CWE-416) in Foxit PDF Editor and Foxit Reader affecting the handling of PDF annotations. Reentrant deletion of an annotation, triggered via embedded JavaScript, can cause the application to dereference an annotation object after it has been freed, resulting in a use-after-free condition and application crash. Affected parties are end users and enterprises running vulnerable Foxit PDF Editor/Reader builds; impact per CVSS is high (7.8) with confidentiality, integrity, and availability all rated High, though exploitation requires local access and user interaction (opening a crafted PDF).

Technical Analysis

The vulnerability resides in Foxit's annotation-handling subsystem. PDF documents support annotation objects (comments, highlights, form fields, markup, and similar interactive elements) that are managed as live objects within the application's document model. When embedded JavaScript in a malicious PDF triggers deletion of an annotation during a callback or event handler that is itself still processing that annotation, a reentrant condition occurs: the object is released while the original code path continues to hold a reference to it. Because the lifetime of the annotation object is invalidated mid-execution, subsequent access on that path becomes a read/write against freed heap memory — the classic use-after-free pattern (CWE-416).

Key technical facts derivable from the advisory:

• The flaw is a memory-safety issue, specifically a use-after-free, not a logic or privilege defect.
• The trigger is reentrant annotation deletion driven by embedded JavaScript inside a PDF — a client-side, document-triggered attack surface.
• The observable consequence stated is application crash, which is consistent with heap corruption from a stale pointer dereference.

Insufficient technical detail is available to name specific functions, objects, or API methods involved; the advisory does not disclose the precise call path, which annotation type is affected, or which JavaScript API invokes deletion. No CWE-416 root-cause specifics (e.g., missing reference counting, absent null-out after free) are provided in the source data, so those details should not be assumed.

The attack surface is the PDF parsing and rendering engine's annotation event infrastructure. Because annotation deletion can be reentered from JavaScript, any document-processing path that dispatches events to annotations synchronously is potentially exposed. CVSS AV:L (Local) and UI:R (User Interaction Required) reflect that the attacker must deliver a file and convince a user to open it; the AC:L score indicates the condition is reliably reproducible once the trigger is present. The S:U scope indicates the exploit impact stays within the application's security context.

Given C:H/I:H/A:H, the crash indicates memory corruption that in principle could be developed beyond a denial-of-service into code execution or information disclosure. However, the advisory only confirms a crash condition; escalation to arbitrary code execution is a theoretical extrapolation of the vulnerability class and is not stated in the source data.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available. The attack chain below is inferred from the vulnerability class and the advisory description only; no specific function names, JavaScript methods, or code patterns are asserted.

1. Reconnaissance / target identification: The attacker identifies victims running Foxit PDF Editor or Foxit Reader. Delivery is client-side — targeting users and organizations that process untrusted PDFs (invoice workflows, support inboxes, document portals). No network service is fingerprinted; targeting is user- and file-centric.

2. Triggering the flaw class: The attacker crafts a PDF containing an annotation and embedded JavaScript. The JavaScript is arranged to cause the annotation to be deleted during an event or callback that is still processing that same annotation, producing the reentrant deletion condition described in the advisory. The precise event and deletion mechanism are not disclosed and must not be assumed.

3. Payload/execution method: Delivery is via a malicious PDF opened in the vulnerable application. Exploitation requires user interaction (UI:R) — the victim must open the file and allow the JavaScript/event handling to execute. The trigger is confined to the parsing/rendering of the document; no server-side interaction is required.

4. Post-exploitation impact: Demonstrating the vulnerability yields an application crash from the use-after-free. Because the CVSS impact ratings are Confidentiality/Integrity/Availability: High, the underlying memory-corruption condition could plausibly be leveraged for further primitives (heap manipulation, control-flow or data disclosure) by a skilled attacker, but the source data confirms only the crash. In an enterprise context, even the confirmed level of exploitation is a reliable denial-of-service / application crash vector against Foxit users, and a foothold for deeper exploitation if the memory bug proves controllable.

Impact Assessment

CVSS 3.1 base score 7.8 (High), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Subscore interpretation:

• AV:L — attack is local, i.e., delivered as a file rather than over a network service.
• AC:L — the trigger is considered reliably achievable; no special race or timing beyond the described reentrancy is required.
• PR:N — no prior privileges needed.
• UI:R — the victim must open the malicious PDF; this raises the bar for mass exploitation.
• S:U — impact is limited to the vulnerable application's context.
• C:H/I:H/A:H — high confidentiality, integrity, and availability impact potential, consistent with memory-corruption bugs that can be weaponized beyond a simple crash.

Blast radius: any endpoint — workstation, laptop, server-side document processing host — running a vulnerable Foxit PDF Editor/Reader build. Enterprises that centralize PDF handling (legal, insurance, finance, healthcare document intake) face concentrated exposure. Consumer users are also affected. Because exploitation requires user interaction and local file access, worm-like or unauthenticated remote propagation is not indicated.

Operational impact: confirmed crash/reliability impact against Foxit clients, potential for targeted memory-corruption exploitation if a weaponized variant is developed, and potential data exposure if the use-after-free is turned into an information-disclosure primitive. This CVE is NOT listed in CISA KEV, and no exploit-in-the-wild evidence is present in the source data.

Detection Guidance

Sigma Rule

Detects Foxit Reader/Editor process crashes on endpoints, which is a signal of attack attempts against this use-after-free.

title: Potential Foxit PDF Annotation Use-After-Free Exploitation (CVE-2026-91816)
id: 8f4b1c2e-1a7d-4c9b-9c2e-000000091816
status: experimental
description: Detects crashes of Foxit PDF Editor/Reader processes associated with malicious PDF annotation handling (use-after-free, CWE-416), indicative of attempted exploitation of CVE-2026-91816.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91816
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\Foxit Reader.exe'
  selection_crash:
    - ExitCode: '0xC0000005'   # access violation
    - ExitCode: '0xC0000409'   # stack buffer overrun / fail fast
    - ExitCode: '0xC0000374'   # heap corruption
    - ExitCode: '-1073741819'  # access violation (decimal)
  condition: selection_image and selection_crash
falsepositives:
  - Legitimate Foxit crashes unrelated to exploitation
  - Outdated/corrupted Foxit installations
level: medium

YARA Rule

Detects PDFs that combine annotation keywords with embedded JavaScript, consistent with the described exploitation vector.

rule PDF_Annotation_JS_UseAfterFree_CVE_2026_91816
{
    meta:
        description = "Detects PDFs containing embedded JavaScript and annotation objects, consistent with the CVE-2026-91816 annotation use-after-free vector"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91816"
        date = "2026-01-01"
        cve = "CVE-2026-91816"
        severity = "high"

    strings:
        $pdf = { 25 50 44 46 }                    // %PDF
        $anth = "/Annot"
        $annots = "/Annots"
        $js = "/JavaScript"
        $jss = "/JS"
        $openaction = "/OpenAction"
        $aa = "/AA"                               // additional-actions
        $del = "deleteAnnot"

    condition:
        $pdf at 0 and
        (size < 5MB) and
        ($js or $jss) and
        ($anth or $annots or $openaction or $aa)
}

Suricata IDS Rule

Flags retrieval of PDF files over HTTP that exhibit JavaScript and annotation markers — relevant where documents are delivered by web download.

alert http any any -> any any (msg:"CVE-2026-91816 Possible Foxit PDF Annotation Use-After-Free Delivery (JS + Annot)"; flow:established,to_client; http.response_body; content:"%PDF"; depth:4; http.response_body; content:"/Annot"; http.response_body; content:"/JavaScript"; classtype:attempted-user; reference:cve,CVE-2026-91816; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91816; metadata:affected_product Foxit_PDF_Reader, affected_product Foxit_PDF_Editor, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2026_01_01; sid:600918001; rev:1;)

Elastic Detection

Detects Foxit process termination events with crash exit codes on Windows endpoints.

process where process.name in ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "Foxit Reader.exe") and
  process.exit_code in (3221225477, 3221226505, 3221226356) and
  event.action == "end"

Splunk SPL Query

Correlates Foxit crashes with recent PDF downloads to surface likely exploitation attempts.

index=endpoint sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
| search (Image="*\\FoxitPDFReader.exe" OR Image="*\\FoxitPDFEditor.exe" OR Image="*\\Foxit Reader.exe")
        (EventCode=1 OR EventCode=10)
| where match(lower(TargetFilename), "\.pdf$") OR match(lower(CommandLine), "\.pdf")
| stats count values(TargetFilename) as pdf_files values(CommandLine) as cmd by Computer, User, Image
| where count > 0
| sort - count

Wazuh OSSEC Rule

Detects Foxit crash loop on managed endpoints via Windows application event log.

<group name="windows,cve-2026-91816,">
  <rule id="100918" level="10">
    <if_sid>60000</if_sid>
    <field name="win.system.providerName">Application Error</field>
    <field name="win.eventdata.application">FoxitPDFReader.exe|FoxitPDFEditor.exe|Foxit Reader.exe</field>
    <description>CVE-2026-91816: Foxit PDF application crash - possible malicious annotation use-after-free exploitation</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>foxit,pdf,cve_2026_91816,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source; no vendor fix or workaround in the source data).

1. Immediate mitigations (compensating controls, until a vendor fix exists):

• Disable JavaScript execution in Foxit PDF Editor/Reader via Preferences → JavaScript and uncheck "Enable JavaScript Actions." This directly removes the described trigger (embedded JavaScript driving reentrant annotation deletion).
• Restrict or block the opening of PDFs from untrusted sources (email attachments, downloads, web portals) at the mail gateway/web proxy via file-type allow-listing and sandboxing.
• Enforce application allow-listing and least privilege on endpoints so a crash/exploit cannot easily escalate within the host.
• Consider using an alternative hardened PDF viewer for processing untrusted documents while Foxit remains unpatched.
• Monitor Foxit crash telemetry (see Detection Guidance) to identify attempted exploitation in progress.

2. Patch/upgrade steps:

• No patch is available per tracked sources. Monitor Foxit's official security advisories and release notes for CVE-2026-91816 and apply the vendor fix immediately upon release.
• Validate the installed Foxit build against the vendor's fixed version when published; subscribe to Foxit security bulletins and the NVD entry for status changes.

3. Long-term hardening:

• Apply the principle of least functionality by permanently disabling JavaScript in PDF clients unless a documented business need exists.
• Deploy endpoint detection with crash-correlation and memory-corruption indicators, and integrate PDF document detonation/sandboxing into intake pipelines.
• Establish a vulnerability management workflow that flags unpatched client-side memory-corruption CVEs as elevated risk and tracks KEV movement.
• User awareness: treat unsolicited PDFs carrying interactive annotations/JS as untrusted, especially from external senders.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91816
• CWE-416 (Use After Free): https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• CISA Known Exploited Vulnerabilities Catalog (status check — CVE-2026-91816 not listed as of data provided): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Foxit Security Advisories / product security bulletins: https://www.foxit.com/support/security-bulletins.html

No known threat-actor campaigns or exploit-in-the-wild evidence are documented for CVE-2026-91816 in the source data; the CVE is not in CISA KEV and no public PoC or exploit code is available.