CVE-2026-91799: Foxit Editor/Reader Array resetForm Use-After-Free Vulnerability

Q: Does exploitation require an attacker to already have access or privileges on the target system?

The CVSS vector indicates local access and no privileges are required. Exploitation also requires user interaction, consistent with a user opening a specially crafted PDF.

Q: What level of impact could successful exploitation have?

Successful exploitation may crash the application or result in arbitrary code execution. The CVSS metrics indicate potential high impact to confidentiality, integrity, and availability.

Published Sep 23, 2026

Updated

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.

Affected Software

9 affected components

Foxit PDF Editor/Reader

All of the following

Any of the following

Foxit PDF Editor<=13.2.5.63482

Foxit PDF Editor>=14.0.0.33046<=14.0.7.33751

Foxit PDF Editor>=2023.1.0.15510<=2023.3.0.23028

Foxit PDF Editor>=2024.1.0.23997<=2024.4.1.27687

Foxit PDF Editor>=2025.1.0.27937<=2025.3.0.35737

Foxit PDF Editor>=2026.1.0.36452<=2026.2.0.39747

Foxit PDF Reader<=2026.2.0.39747

Microsoft Windows

Event History

Sep 23, 2026

CVE Published

via MITRE·07:50 AM

Data Sourced

via MITRE·07:50 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Does exploitation require an attacker to already have access or privileges on the target system?

The CVSS vector indicates local access and no privileges are required. Exploitation also requires user interaction, consistent with a user opening a specially crafted PDF.

What level of impact could successful exploitation have?