CVE-2026-91817: Foxit PDF Editor/Reader AcroForm Out-of-Bounds Read Remote Code Execution Vulnerability
Published Sep 23, 2026
·Updated
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash.
Affected Software
1 affected component
Foxit PDF Editor/Reader
Event History
Sep 23, 2026
CVE Published
via MITRE·07:49 AM
Data Sourced
via MITRE·07:49 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The supplied metrics indicate no privileges are required, but user interaction is required. The attack vector is local, and the malformed content is embedded PDF JavaScript using wide-string deletion ranges.
2
What impact is indicated if exploitation succeeds?
The vulnerability can cause an out-of-bounds read and crash the affected application. The supplied severity vector indicates low confidentiality impact and high availability impact.