CVE-2026-91818

Executive Summary

CVE-2026-91818 is a use-after-free (UAF) vulnerability in Foxit PDF Editor/Reader that is triggered during JavaScript handling of PDF annotations. During annotation enumeration, reentrant page-event processing can free the associated page object, which is then accessed by still-executing logic, causing an application crash or memory corruption. Because exploitation requires user interaction (opening a crafted PDF) and runs at the local privilege level of the victim application, affected organizations are primarily at risk from phishing-delivered weaponized documents. No public proof-of-concept, exploit code, or vendor patch currently exists, and the vulnerability has not been added to CISA KEV or scored by FIRST.org EPSS.

Technical Analysis

The root cause is a memory lifecycle defect classified as CWE-416 (Use-After-Free). In the Foxit PDF Editor/Reader JavaScript engine, annotation objects are iterated or "enumerated" by script logic. Each annotation is associated with a parent page object. The NVD description states that "reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed." In practical terms:

1. Script execution begins enumerating annotations on a page, holding a reference to the page object.
2. A page event is processed reentrantly during that enumeration — event handling re-enters the execution context rather than completing serially.
3. That reentrant processing releases (frees) the page object while the enumerating code still believes the reference is valid.
4. Control returns to the enumeration logic, which dereferences the now-freed page object — a classic dangling-pointer access.

The consequence per the description is an application crash, but the same mechanism is the canonical precondition for memory corruption and, ultimately, arbitrary code execution. A freed object reclaimed by attacker-controlled data ("heap grooming") can redirect control flow through a corrupted virtual function pointer or object vtable. The CVSS vector reflects this risk profile: C:H/I:H/A:H (high confidentiality, integrity, and availability impact) with AV:L (local attack vector), AC:L (low attack complexity), PR:N (no privileges required), UI:R (user interaction required), and S:U (unchanged scope). Because scope is unchanged and the vector is local, the practical exploitation model is a document-based client-side attack running inside the Foxit process sandbox/context rather than a network-reachable server compromise.

The attack surface is the PDF annotation subsystem combined with embedded JavaScript. Affected product is Foxit PDF Editor/Reader; the provided data does not specify version boundaries. No function names, object names, or internal APIs can be asserted beyond "JavaScript handling of PDF annotations" and "page-event processing," which are the only implementation details supplied.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (use-after-free via reentrant event processing during annotation enumeration). It does not rely on any function, endpoint, or parameter names beyond those in the NVD description.

1. Reconnaissance / target identification. The attacker identifies targets whose users open PDFs in Foxit PDF Editor/Reader — finance, legal, engineering, and government are common recipients of PDF-heavy workflows. Because AV:L and UI:R apply, the attacker does not scan for a network service; instead they build a victim profile for document delivery.

2. Delivery of a crafted PDF. The malicious PDF is delivered by phishing email attachment, a link to a hosted file, or a shared drive. The trigger requires the victim to open the document with the vulnerable Foxit product. The malicious document contains JavaScript logic that enumerates annotations and induces page-event processing to re-enter while the enumeration is still in flight, freeing the page object mid-iteration.

3. Triggering the flaw class. Opening the document causes Foxit to execute the embedded PDF JavaScript. During annotation enumeration, reentrant page-event handling releases the page object; the enumeration logic then accesses the freed memory. This is the UAF trigger. No specific object or method names can be asserted from the available data.

4. Payload/execution method at the class level. For a reliability-focused weapon, the attacker would arrange heap allocations so the freed page object's memory is reclaimed with controlled data, turning the dangling access into a controlled memory-corruption primitive. With sufficient control, the primitive can be leveraged to hijack execution inside the Foxit process. The NVD description only confirms crash as the observed outcome; remote code execution is the potential escalation path implied by the high I/I/H CVSS impact scores, not a documented in-the-wild behavior.

5. Post-exploitation impact. If code execution is achieved, the attacker runs in the context of the victim user interacting with the PDF. Actions would include establishing persistence, harvesting documents and credentials, and pivoting laterally using the compromised user's tokens. Even without code execution, repeated crash triggering against document-processing pipelines may cause denial-of-service.

Because no public exploit exists and the vendor has published no advisory in the provided data, defenders should treat the exploit chain as theoretical but consistent with known Foxit annotation/JavaScript UAF tradecraft.

Impact Assessment

Business impact is concentrated in endpoint/client-side data. The CVSS 3.1 base score is 7.8 (High), derived from AV:L, AC:L, PR:N, UI:R, S:U, C:H, I:H, A:H. The high integrity and confidentiality ratings mean that a successful exploit could enable modification of documents and disclosure of sensitive file content under the victim user's privileges, while the high availability rating reflects a guaranteed crash at minimum. Blast radius is per-endpoint: each user who opens a malicious PDF on a system with the vulnerable product is an independent victim. In organizations where PDFs are processed automatically by convertors, indexers, or RPA pipelines built on Foxit, a single document can affect multiple hosts. No EPSS score or KEV listing exists, so there is currently no measured exploitation pressure, but the UAF class and the ubiquity of PDFs in enterprise scanning/OCR and legal workflows elevate residual risk. Because patch confidence is 0/4 and no workarounds are documented, defenders must plan compensating controls rather than relying on a fix.

Detection Guidance

Sigma Rule

title: Foxit PDF Editor/Reader Use-After-Free Crash via JavaScript Annotation Handling
id: 8e3f7c41-2b0d-4a96-9f2e-1c5d7a9b0e23
status: experimental
description: Detects crashes of Foxit PDF Editor/Reader caused by use-after-free in JavaScript annotation handling (CVE-2026-91818). Correlates application crash events from reading of untrusted PDFs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91818
author: valtersit.com
tags:
  - attack.t1203
  - cve.2026-91818
logsource:
  category: application
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
      - '\FoxitPDFReader.exe'
  selection_crash:
    EventID:
      - 1000
      - 1001
    Message|contains:
      - 'Foxit'
    Message|re: '(?i)annotation|page|javascript|jscript'
  condition: selection_process and selection_crash
fields:
  - Image
  - EventID
  - Message
  - User
falsepositives:
  - Legitimate Foxit crashes from malformed but non-malicious PDFs
level: medium

YARA Rule

rule CVE_2026_91818_Foxit_UAF_Annotation_JS
{
    meta:
        author = "valtersit.com"
        description = "Detects PDFs containing JavaScript annotation enumeration logic that may trigger use-after-free in Foxit PDF Editor/Reader (CVE-2026-91818)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91818"
        cve = "CVE-2026-91818"
        date = "2026-01-01"
    strings:
        $pdf_magic = "%PDF-"
        $js1 = "/JavaScript" ascii nocase
        $js2 = "/JS" ascii nocase
        $annot = "/Annots" ascii
        $event = "/AA" ascii
        $open = "/OpenAction" ascii
        $enum1 = "getAnnots" ascii nocase
        $enum2 = "numFields" ascii nocase
        $enum3 = "annot" ascii nocase
        $event2 = "page" ascii nocase
    condition:
        $pdf_magic at 0 and
        ($js1 or $js2) and
        ($open or $event) and
        ($annot or $enum1 or $enum2 or $enum3) and
        $event2
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91818 Foxit PDF Annotation JavaScript UAF - PDF Download"; flow:to_client,established; fileext:"pdf"; filemagic:"PDF document"; content:"%PDF-"; depth:5; content:"/JavaScript"; nocase; content:"/Annots"; within:2048; content:"/OpenAction"; nocase; within:2048; classtype:attempted-user; reference:cve,CVE-2026-91818; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-91818; sid:9009181; rev:1;)

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91818 Foxit PDF Annotation JavaScript UAF - HTTP Download"; flow:to_client,established; http.content_type:"application/pdf"; content:"%PDF-"; depth:5; content:"/JavaScript"; nocase; content:"/Annots"; nocase; within:4096; classtype:attempted-user; reference:cve,CVE-2026-91818; sid:9009182; rev:1;)

Note: Because the trigger occurs inside the desktop application and not on the wire, the above rules target delivery of suspicious annotated PDFs rather than the UAF itself. Host telemetry (Sigma/Elastic/Wazuh) is the authoritative detection layer for this CVE.

Elastic Detection

process where process.name : ("FoxitPDFEditor.exe", "FoxitReader.exe", "FoxitPDFReader.exe")
  and
  (
    event.category == "process" and event.action == "end" and process.exit_code >= 0xC0000005
  )
  or
  (
    event.category == "file" and file.extension == "pdf" and event.action == "creation" and
    file.name != null
  )

Sequencing query to correlate suspicious PDF access with an immediate Foxit crash:

sequence by host.id, user.name with maxspan = 30s
  [ file where event.action == "access" and file.extension == "pdf" ]
  [ process where process.name : ("FoxitPDFEditor.exe", "FoxitReader.exe")
      and event.category == "process" and event.action == "end" ]

Splunk SPL Query

index=endpoint OR index=windows (source="XmlWinEventLog:Application" OR source="Application")
   EventCode=1000
   (Message="*FoxitPDFEditor.exe*" OR Message="*FoxitReader.exe*" OR Message="*FoxitPDFReader.exe*")
| rex field=Message "(?<faulting_process>[^\\\s]+\.exe)"
| rex field=Message "(?<faulting_module>[^\\\s]+\.dll)"
| where faulting_process IN ("FoxitPDFEditor.exe","FoxitReader.exe","FoxitPDFReader.exe")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(faulting_module) as modules by host, faulting_process, user
| where count >= 1
| sort - count
| table host, user, faulting_process, modules, count, first_seen, last_seen

Wazuh OSSEC Rule

<group name="foxit,cve-2026-91818,application_crash">
  <rule id="100918" level="8">
    <decoded_as>json</decoded_as>
    <field name="win.system.providerName">Application Error</field>
    <field name="win.system.eventID">^1000$</field>
    <field name="win.eventdata.application" type="pcre2">(?i)Foxit(PDFEditor|Reader|PDFReader)\.exe</field>
    <description>Foxit PDF Editor/Reader application crash - possible CVE-2026-91818 annotation JavaScript use-after-free</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>sysmon_event_unknown,</group>
  </rule>
  <rule id="100919" level="10">
    <if_sid>100918</if_sid>
    <field name="win.eventdata.faultingModuleName" type="pcre2">(?i)Foxit.*(pdf|js|javascript|fx).*\.dll</field>
    <description>Foxit crash in PDF/JavaScript module - high confidence CVE-2026-91818 exploitation attempt</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Note: Wazuh rules above expect JSON Windows Event Channel ingestion; adjust <decoded_as> and field paths to match your decoder configuration for Application Error event 1000.

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No vendor fix, no patch source, and no documented workarounds are available in the provided intelligence.

1. Immediate mitigations (compensating controls).

   • Disable JavaScript execution in Foxit PDF Editor/Reader via the application's JavaScript preference (untick "Enable JavaScript") and enforce this setting through enterprise policy.
   • Block or quarantine inbound PDFs with embedded JavaScript in the mail gateway and web proxy; strip /JavaScript, /JS, and /OpenAction entries where business policy permits content sanitization (e.g., CDR-based PDF flattening).
   • Restrict execution of Foxit binaries to business-justified roles; where PDF viewing only is required, consider a non-scripting reader.
   • Enforce application allowlisting so the Foxit process cannot spawn unexpected child processes.
   • Monitor endpoint crash telemetry (Application Event 1000/1001) for Foxit processes and triage repeated crashes as potential exploitation attempts.

2. Patch/upgrade steps.

   • There is no patch to deploy currently. Subscribe to the Foxit security advisory feed and watch for a release addressing CVE-2026-91818.
   • When a fixed version is published, test and deploy through your standard software deployment ring, prioritizing endpoints that open externally sourced PDFs.
   • Verify the deployed build by checking the version and, after release, the vendor advisory's fixed version list. Until then, do not assume any installed build is patched.

3. Long-term hardening.

   • Enable and enforce Microsoft Defender Attack Surface Reduction rules and exploit protection (DEP, ASLR, CFG, RFG) for the Foxit process where supported.
   • Run Foxit in a sandboxed or isolated environment for high-risk users (legal, finance, HR) and route untrusted PDFs through a disposable container.
   • Integrate crash telemetry, EDR process-end events, and file-access data into a correlation rule set (see Detection Guidance) and continuously tune for false positives from benign malformed PDFs.
   • Maintain a PDF ingestion policy requiring safe rendering / sanitization for all inbound documents.

References

• NVD — CVE-2026-91818: https://nvd.nist.gov/vuln/detail/CVE-2026-91818
• MITRE CWE-416 — Use After Free: https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK — T1203 Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• CISA Known Exploited Vulnerabilities Catalog (check status for CVE-2026-91818 — currently NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (check score for CVE-2026-91818 — not yet scored at time of writing): https://www.first.org/epss/
• Foxit Software security advisories and product updates (vendor advisory pending — none referenced in the provided data): https://www.foxit.com/support/security-bulletins.html

No threat actor campaigns or exploit-in-the-wild evidence are known or reported for CVE-2026-91818 in the provided data. CISA KEV status: NO. Public PoC: None. Exploit code: None. Nuclei template: None.