Medium severity6.1NVD Advisory· Published Sep 23, 2026· Updated Oct 8, 2026

CVE-2026-91808

Description

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Foxitsoftware/PDF Editor
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
Range: <=13.2.5.63482
Foxitsoftware/PDF Reader
cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*
Range: <=2026.2.0.39747
Foxitsoftware/PDF Editor/Readerllm-create

Patches

Vulnerability mechanics

References

www.foxit.com/support/security-bulletins.htmlnvdVendor Advisory

News mentions

ZDI-26-737: Foxit PDF Reader JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Zero Day Initiative · Sep 23, 2026

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000