CVE-2026-91817

Executive Summary

CVE-2026-91817 is a heap-based out-of-bounds read vulnerability (CWE-125) in Foxit PDF Editor/Reader when processing wide strings contained in embedded PDF JavaScript. Insufficient validation of string-deletion ranges allows an integer underflow that leads to an out-of-bounds read and application crash. The vulnerability is rated CVSS 3.1 base score 6.1 (Medium) and affects users who open a crafted PDF in the vulnerable Foxit product; no patch, public proof-of-concept, or exploit code is currently available from tracked sources.

Technical Analysis

The flaw resides in the component that handles wide strings within embedded PDF JavaScript. PDF documents can embed JavaScript that is executed by the host application's JavaScript engine when the document is opened, provided the user's configuration permits script execution. Foxit's JavaScript implementation operates on wide (typically 16-bit/UTF-16-style) character strings for text processing.

According to the NVD description, the vulnerability is triggered by insufficient validation of string-deletion ranges. When the application computes the range of characters to delete from a wide string, a boundary condition causes an integer underflow — a length or range value wraps around to a very large unsigned value (or otherwise becomes invalid). Because the code does not validate the resulting range before use, a subsequent read operation accesses memory outside the bounds of the allocated heap buffer, producing an out-of-bounds read on the heap.

The primary demonstrated consequence is an application crash, which corresponds to the CVSS availability impact of High (A:H). The confidentiality impact is rated Low (C:L), indicating that out-of-bounds read contents may be partially exposed or leaked under certain conditions, though the description explicitly emphasizes the crash outcome. Integrity impact is None (I:N).

The relevant weakness class is CWE-125: Out-of-bounds Read, with the root-cause precondition being inadequate integer/range validation prior to a memory read operation. The attack vector is Local (AV:L) with User Interaction Required (UI:R) — meaning the attacker must deliver a malicious file to the victim and the victim must open/render it. No privileges are required (PR:N) and the vulnerable component scope is unchanged (S:U).

No specific function names, class names, file paths, or API parameters are disclosed in the NVD description or CNA title; accordingly, this report does not speculate on implementation identifiers beyond the wide-string and string-deletion-range processing behavior that is explicitly described.

Exploitation Scenarios

No public proof-of-concept or exploit code is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. An attacker identifies potential victims who use Foxit PDF Editor/Reader and who are likely to open PDF attachments or download PDFs from untrusted sources. The attacker profiles targets (for example, through phishing lures, industry mailing lists, or web-hosted document delivery) to maximize the probability that the crafted document will be opened.

2. Trigger of the flaw class. The attacker crafts a PDF document containing embedded JavaScript that manipulates wide strings. By supplying a string-deletion operation whose computed range is not properly validated, the attacker drives the length/range value into an integer underflow, so that the deletion routine derives an invalid (effectively oversized) range. This causes the wide-string handling code to perform a read outside the bounds of its heap buffer.

3. Execution / delivery method. The crafted PDF is delivered to the victim via email attachment, a downloaded file, or a hosted link. Because exploitation requires user interaction (UI:R), the victim must open the document in the vulnerable Foxit product. If the victim's configuration allows embedded JavaScript execution, the malicious script is evaluated and the vulnerable string-deletion path is reached. The immediate observable effect is an out-of-bounds heap read followed by an application crash; under the CVSS assumptions, limited memory disclosure (C:L) is also possible.

4. Post-exploitation impact. As described, the demonstrated impact is a denial-of-service / crash of Foxit PDF Editor/Reader (A:H). The description does not establish memory-corruption primitives, arbitrary code execution, or persistence. While out-of-bounds reads can sometimes be chained into information disclosure or further exploitation, no such capability is asserted for this CVE by the available data, and no exploit code exists publicly. The realistic near-term impact is availability disruption on the host running Foxit, with a secondary, limited confidentiality exposure.

Impact Assessment

• Business impact: An attacker can reliably crash the Foxit PDF Editor/Reader application on a targeted endpoint by delivering a crafted PDF containing malicious embedded JavaScript. Users who routinely open untrusted PDFs (e.g., finance, legal, HR, help-desk staff) are most exposed. A crash can interrupt work, and repeated delivery can be used for nuisance or denial-of-service effects.
• Affected systems: Endpoints (workstations and servers) running affected versions of Foxit PDF Editor/Reader. Exact affected version boundaries are not published in the provided data (Affected Versions: []).
• Blast radius: Limited to the local host where the document is opened; scope is unchanged (S:U).
• CVSS 3.1 subscores: AV:L (local vector — the malicious document must be present/opened on the target), AC:L (low attack complexity), PR:N (no privileges required), UI:R (victim must open the document), S:U (unchanged scope), C:L (low confidentiality impact), I:N (no integrity impact), A:H (high availability impact). Base score 6.1 (Medium).
• Exploitation likelihood: EPSS has not yet scored this CVE. No public PoC, exploit code, or Nuclei template is available. CISA KEV does not list this CVE, so there is no confirmed exploitation in the wild as of this writing.

Detection Guidance

Sigma Rule

title: Potential Foxit PDF Reader/Editor Wide String Out-of-Bounds Read Crash (CVE-2026-91817)
id: 7b6f2c1e-3a4d-4f9b-9c2e-000000091817
status: experimental
description: Detects abnormal termination of Foxit PDF Editor/Reader processes, consistent with a crash caused by a crafted PDF containing embedded JavaScript that triggers a heap out-of-bounds read via a wide-string deletion integer underflow.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91817
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1203
  - cve.2026-91817
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
  selection_crashexit:
    ExitCode:
      - '0xC0000005'
      - '0xC0000094'
      - '0xC0000095'
      - '-1073741819'
      - '-1073741676'
  condition: selection_process and selection_crashexit
falsepositives:
  - Legitimate application faults unrelated to exploitation
  - Corrupted or malformed PDFs from trusted sources
level: medium

YARA Rule

rule CVE_2026_91817_Foxit_WideString_OOB_Read
{
    meta:
        description = "Detects PDFs embedding JavaScript that manipulates wide strings in a manner consistent with the CVE-2026-91817 out-of-bounds read trigger"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91817"
        date = "2026-01-01"
        cve = "CVE-2026-91817"

    strings:
        $pdf_header = { 25 50 44 46 2D }              // %PDF-
        $js1 = "/JavaScript" ascii nocase
        $js2 = "/JS" ascii nocase
        $js3 = "app.alert" ascii nocase
        $js4 = "this.getField" ascii nocase
        $wide_hint1 = "charCodeAt" ascii nocase
        $wide_hint2 = "substr" ascii nocase
        $wide_hint3 = "slice" ascii nocase
        $utfmarker = { FE FF }                          // common wide-string/UTF-16 BOM marker

    condition:
        $pdf_header at 0 and
        (2 of ($js1, $js2, $js3, $js4)) and
        (1 of ($wide_hint1, $wide_hint2, $wide_hint3)) and
        $utfmarker
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91817 Foxit PDF Embedded JavaScript Wide-String OOB Read Delivery Attempt"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"/JavaScript"; nocase; distance:0; within:2048; content:"charCodeAt"; nocase; distance:0; within:4096; filestore; classtype:attempted-user; reference:cve,2026-91817; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91817; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:90091817; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitReader.exe") and
  process.exit_code in (-1073741819, -1073741676, -1073741795)

Splunk SPL Query

index=main sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
(EventCode=1 OR EventID=1)
(Image="*\\FoxitPDFReader.exe" OR Image="*\\FoxitPDFEditor.exe" OR Image="*\\FoxitReader.exe")
| eval crash=if(match(lower(CommandLine), "(?i)\.pdf"), "pdf-open", "other")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdline by host, User, Image
| where count >= 1
| sort - last_seen

Wazuh OSSEC Rule

<group name="windows,sysmon,cve-2026-91817,">
  <rule id="100917" level="8">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">FoxitPDFReader.exe|FoxitPDFEditor.exe|FoxitReader.exe</field>
    <description>CVE-2026-91817: Possible Foxit PDF Editor/Reader crash triggered by crafted embedded JavaScript (wide-string out-of-bounds read)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve_2026_91817,vulnerability_exploitation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Disable/restrict JavaScript execution in Foxit PDF Editor/Reader via the application's trust manager / JavaScript preferences, so embedded scripts are not evaluated when documents are opened.
   • Enable Protected Mode / read-only sandboxing where available in the product, to limit the impact of a memory-safety fault.
   • Block or quarantine untrusted PDFs at email and web gateways; apply attachment filtering for documents from unknown senders.
   • Educate users not to open PDFs from untrusted or unexpected sources, since exploitation requires the user to open the document (UI:R).
   • Consider temporarily using an alternative PDF reader for untrusted documents until a fix is available.

2. Patch / upgrade steps.

   • No patch or fixed version has been identified by tracked sources. Monitor Foxit's official security advisories and release notes for a fixed version; upgrade immediately once a patched build is published. Until then, treat all versions as potentially affected and rely on the mitigations above.

3. Long-term hardening.

   • Maintain a documented patch/vulnerability management process that tracks vendor advisories for Foxit and other document-viewing software.
   • Enforce least privilege on endpoints to reduce the impact of client-side memory-safety vulnerabilities.
   • Deploy endpoint detection and response (EDR) with crash telemetry and application-control to detect and constrain abnormal Foxit process behavior.
   • Favor application sandboxing and exploit-mitigation technologies (ASLR, DEP/CFG) at the OS level.

References

• NVD — CVE-2026-91817: https://nvd.nist.gov/vuln/detail/CVE-2026-91817
• MITRE CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-91817 at the time of writing. No public PoC, exploit code, or Nuclei template has been observed.