CVE-2026-91802: Foxit PDF Editor/Reader — Heap Buffer Overflow in WebP Image Decoding via Bitmap Stride Confusion
Published Sep 23, 2026
·Updated
A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash.
Affected Software
9 affected components
Foxit PDF Editor/Reader
All of the following
Any of the following
Foxit PDF Editor<=13.2.5.63482
Foxit PDF Editor>=14.0.0.33046<=14.0.7.33751
Foxit PDF Editor>=2023.1.0.15510<=2023.3.0.23028
Foxit PDF Editor>=2024.1.0.23997<=2024.4.1.27687
Foxit PDF Editor>=2025.1.0.27937<=2025.3.0.35737
Foxit PDF Editor>=2026.1.0.36452<=2026.2.0.39747
Foxit PDF Reader<=2026.2.0.39747
Microsoft Windows
Event History
Sep 23, 2026
CVE Published
via MITRE·07:50 AM
Data Sourced
via MITRE·07:50 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What user interaction is required for exploitation?
The CVSS vector indicates user interaction is required. An attacker would need a user to process attacker-controlled content in the affected application.
2
Does exploitation require prior access or authentication?
No privileges are required according to the CVSS vector. The attack vector is local, so exploitation is not described as remotely reachable over a network.
3
What is the potential impact beyond an application crash?
The CVSS metrics rate confidentiality, integrity, and availability impact as high. However, the provided description specifically confirms that successful exploitation could crash the application.