CVE-2026-91796: Foxit PDF Editor/Reader importIcon NTLM Response Information Disclosure Vulnerability
The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Foxit PDF Editor or Reader who open a specially crafted PDF are exposed. The issue is local in scope and requires user interaction, but it does not require prior privileges.
What must an attacker do to exploit it?
The attacker must craft a PDF that triggers external SMB authentication and induce a user to open it in Foxit PDF Editor or Reader. No security prompt is shown when the issue is triggered.
What information can be disclosed?
The affected application can send an NTLM authentication response to an external SMB endpoint, exposing a hash of the user's credentials. The provided information does not indicate direct credential recovery or account compromise.
Is secure reading mode sufficient protection?
No. The vulnerability is caused by missing permission verification for secure reading mode, allowing the external SMB authentication to occur without a prompt.