Foxit PDF Reader Suffers Remote Code Execution Vulnerability via U3D Parsing Flaw
A critical integer overflow vulnerability in Foxit PDF Reader's U3D file parsing component allows remote attackers to execute arbitrary code on affected systems.
Zero Day Initiative (ZDI) has disclosed a critical remote code execution vulnerability, identified as ZDI-26-721, affecting Foxit PDF Reader. The flaw stems from an integer overflow within the software's U3D file parsing capabilities, a component used to render 3D graphics embedded in PDF documents.
Attackers can exploit this vulnerability by tricking users into opening a specially crafted PDF file containing malicious U3D content or by directing them to a compromised webpage that hosts such a file. Successful exploitation would allow an attacker to execute arbitrary code within the context of the current process, potentially leading to a full system compromise. The vulnerability carries a CVSS score of 7.8, indicating a high severity.
The specific technical root cause lies in the improper validation of user-supplied data during the parsing of U3D files. This oversight can lead to an integer overflow condition before a buffer is allocated, creating an opportunity for attackers to overwrite memory and inject malicious code. The requirement for user interaction, either by opening a malicious file or visiting a malicious link, is a common vector for this type of vulnerability.
Foxit has acknowledged the vulnerability and has released an update to address the issue. Users of Foxit PDF Reader are strongly advised to apply the available patch as soon as possible to mitigate the risk of exploitation. Further details on the security bulletin and the update can be found on Foxit's official security advisories page.
The disclosure timeline indicates that the vulnerability was initially reported to Foxit on June 16, 2026. Following a coordinated disclosure process, the advisory was publicly released on September 23, 2026, with an update to the advisory also occurring on the same day. This timeline reflects a standard practice for vulnerability management, allowing vendors time to develop and distribute patches before public disclosure.
The vulnerability was discovered and reported by researcher Liang Zhu. The Zero Day Initiative, a program operated by Trend Micro, plays a crucial role in discovering and responsibly disclosing security vulnerabilities, working with vendors to ensure that patches are available before publicizing the details.
This vulnerability highlights the ongoing risks associated with complex file parsing components in widely used software. PDF readers, in particular, are frequent targets due to their prevalence and the rich media capabilities they support, including 3D graphics. Organizations should maintain vigilance and ensure their software is kept up-to-date to protect against such threats.
While the CVSS score is high, the requirement for user interaction means that social engineering tactics will likely be a key component in any successful exploitation attempts. Users should remain cautious about opening unexpected attachments or clicking on suspicious links, even from seemingly trusted sources.
This new advisory from Zero Day Initiative details a local privilege escalation vulnerability, ZDI-26-742, affecting Foxit PDF Reader's FoxitUpdater component. The flaw stems from a race condition due to improper locking during update operations, allowing an attacker with initial low-privilege code execution to gain SYSTEM privileges. This advisory is distinct from the previously reported RCE vulnerability (ZDI-26-742) related to U3D parsing, focusing instead on privilege escalation within the update mechanism.
This new advisory details a separate critical vulnerability in Foxit PDF Reader, identified as ZDI-26-740 and assigned CVE-2026-91811. The flaw stems from an out-of-bounds write during the parsing of PRC streams, distinct from the U3D parsing flaw previously reported. While both vulnerabilities allow for remote code execution, this new one requires user interaction by opening a malicious file or visiting a malicious webpage.