CVE-2026-91811: Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to do to trigger this issue?
The victim must open or otherwise process a crafted PDF containing PRC data with a triangular fan texture mesh that uses invalid vertex indices. The CVSS vector indicates local attack vector, no privileges required, and user interaction required.
What is the likely impact if exploitation succeeds?
The vulnerable PRC parser can perform a heap-based out-of-bounds write, causing memory corruption. The stated potential impact includes application crash, while the CVSS vector rates confidentiality, integrity, and availability impact as high.
How can I determine whether a PDF may be attempting to exploit this vulnerability?
Inspect suspicious PDFs for embedded PRC content, particularly triangular fan texture meshes with malformed or out-of-range vertex indices. The provided information does not identify affected Foxit versions or a specific detection signature.