Foxit PDF Editor/Reader: 23 Vulnerabilities Disclosed in Single Batch, Affecting Multiple Components
A coordinated disclosure event on September 23, 2026, revealed 23 vulnerabilities in Foxit PDF Editor/Reader, ranging from critical memory corruption flaws to privilege escalation.
Key findings
- 23 vulnerabilities disclosed simultaneously for Foxit PDF Editor/Reader on September 23, 2026.
- Flaws include heap-based buffer overflows, use-after-free errors, and privilege escalation.
- Multiple CVEs relate to improper handling of images (JPEG2000, PRC, U3D, WebP) and PDF structures.
- Use-after-free vulnerabilities are frequently triggered by JavaScript or malformed PDF elements.
- Two critical vulnerabilities allow local privilege escalation via the update mechanism.
- Foxit has released updates to address all disclosed vulnerabilities.
On September 23, 2026, a significant batch of 23 vulnerabilities was disclosed for Foxit PDF Editor and Reader, impacting various components and functionalities of the software. These vulnerabilities, ranging in severity from Medium to High, were all disclosed on the same day, indicating a coordinated disclosure event. The sheer volume and diversity of these flaws highlight potential systemic weaknesses in how Foxit handles complex PDF features, including image parsing, JavaScript execution, and update mechanisms.
Several vulnerabilities stem from improper handling of image data. CVE-2026-91815, a High severity flaw, involves insufficient verification of JPEG2000 image metadata, leading to an out-of-bounds write that could result in arbitrary code execution. Similarly, CVE-2026-91811 (High) describes a heap-based out-of-bounds write in the PRC parser due to invalid vertex indices, and CVE-2026-91812 (High) points to an issue in the update mechanism allowing man-in-the-middle attackers to bypass certificate validation. CVE-2026-91802 (High) involves a heap-based out-of-bounds write during WebP image decoding, while CVE-2026-91789 (High) details an out-of-bounds write in U3D/GIF texture decoding. CVE-2026-91794 (High) also relates to an out-of-bounds write due to malformed color space data during PDF rendering.
A notable theme among the disclosed vulnerabilities is the exploitation of use-after-free conditions, often triggered by embedded JavaScript or malformed PDF structures. CVE-2026-91816 (High) involves a use-after-free in annotation handling, triggered by reentrant JavaScript deletion. CVE-2026-91809 (High) and CVE-2026-91806 (High) also relate to use-after-free vulnerabilities in form field handling, with the latter specifically mentioning JavaScript access to released form-field references. CVE-2026-91805 (High) describes a use-after-free in page-tree handling, and CVE-2026-91793 (High) and CVE-2026-91792 (High) detail use-after-free conditions during annotation and zoom/layout operations, respectively, often involving JavaScript. CVE-2026-91790 (High) is another use-after-free vulnerability related to page-visibility events and annotation boundary calculations. CVE-2026-91799 (High) involves a use-after-free in JavaScript array object handling.
Privilege escalation is another critical concern highlighted by this batch. CVE-2026-91803 (High) is a local privilege escalation vulnerability in the updater due to unsafe DLL loading from user-writable directories. Complementing this, CVE-2026-91798 (High) is a local privilege escalation vulnerability in the update daemon, stemming from insecure permission configurations that allow modification of configuration files, potentially leading to arbitrary script execution with elevated privileges.
Other vulnerabilities include out-of-bounds reads and writes due to insufficient validation of various PDF elements. CVE-2026-91817 (Medium) is a heap-based out-of-bounds read in JavaScript string handling. CVE-2026-91810 (Medium) is a heap-based out-of-bounds read due to malformed image masks, and CVE-2026-91807 (Medium) is a similar heap-based out-of-bounds read concerning soft-mask data. CVE-2026-91797 (High) involves directory traversal in attachment file names, allowing malicious attachments to be written outside the expected secure area. CVE-2026-91796 (Medium) is an information disclosure vulnerability where the interface lacks permission verification for secure reading mode, allowing crafted PDFs to trigger external SMB authentication and leak user credentials. Finally, CVE-2026-91788 (Medium) is an information disclosure vulnerability where a trusted malicious PDF could access sensitive content from other documents.
Foxitsoftware has addressed these vulnerabilities through updates. Users are strongly advised to update their Foxit PDF Editor and Reader installations to the latest versions to mitigate these risks. The widespread nature of these flaws underscores the importance of regular security patching and vigilance when handling PDF documents from untrusted sources.
The coordinated disclosure of these 23 vulnerabilities on a single day highlights a significant security event for Foxit software users. The range of issues, from memory corruption and privilege escalation to information disclosure, necessitates immediate attention from administrators and end-users alike. Maintaining updated software and practicing cautious document handling remain paramount.