Foxit PDF Reader Vulnerable to Remote Code Execution via AcroForm Flaw

A critical use-after-free vulnerability has been identified in Foxit PDF Reader's AcroForm component, enabling remote attackers to execute arbitrary code on affected installations. The vulnerability, tracked as CVE-2026-91816, requires user interaction, such as opening a malicious file or visiting a compromised webpage, to be exploited. The flaw carries a CVSS score of 7.8, indicating a high severity.

The specific technical weakness lies within how the AcroForm component handles objects. The issue arises from a failure to validate the existence of an object before performing operations on it. This oversight allows an attacker to trigger a use-after-free condition, which can then be leveraged to execute arbitrary code within the context of the current process.

Successful exploitation of this vulnerability could lead to a complete compromise of the user's system. Attackers could potentially install programs, view, change, or delete data, and create new accounts with full user rights. Given that PDF readers are commonly used for everyday tasks, the potential attack surface is significant.

Foxit has acknowledged the vulnerability and has released an update to address the issue. Users are strongly advised to update their Foxit PDF Reader installations to the latest version to mitigate the risk. Further details on the security bulletin can be found on Foxit's official support page.

The vulnerability was reported to the vendor on September 9, 2026, and was publicly disclosed on September 23, 2026, with an advisory update on the same day. The disclosure was coordinated by the Zero Day Initiative (ZDI), with credit given to an anonymous researcher.

This vulnerability adds to a growing list of security flaws discovered in popular PDF readers, highlighting the persistent challenges in securing document parsing software. Attackers frequently target these applications due to their widespread use and the complex nature of file formats they process.

Organizations should ensure their endpoint security solutions are up-to-date and consider implementing additional security measures, such as application sandboxing or restricting the execution of untrusted files, to further reduce the risk of exploitation. Regular patching and security awareness training for users remain crucial defenses against such threats.

The Zero Day Initiative advisory ZDI-26-734 details a separate remote code execution vulnerability in Foxit PDF Reader, distinct from the AcroForm flaw. This new vulnerability, CVE-2026-91801, stems from a directory traversal issue within the RichMedia Annotation feature and carries a CVSS score of 7.8, requiring user interaction for exploitation.

This new advisory from Zero Day Initiative details a distinct use-after-free vulnerability within Foxit PDF Reader's Annotation object handling, assigned CVE-2026-13128. Unlike the previously reported AcroForm flaw, this vulnerability stems from a failure to validate object existence before operations, allowing for arbitrary code execution in the context of the current process.

This advisory details a use-after-free vulnerability within Foxit PDF Reader's annotation handling, distinct from the AcroForm component mentioned previously. The flaw arises from insufficient validation of object existence before operations, potentially allowing remote code execution in the context of the current process. The vulnerability, assigned CVE-2026-91792, carries a CVSS score of 7.8 and requires user interaction, such as opening a malicious file or visiting a malicious webpage, for exploitation.

This new advisory, ZDI-26-722, details a distinct use-after-free vulnerability within Foxit PDF Reader's Annotation object handling, separate from the AcroForm component mentioned previously. The vulnerability, tracked as CVE-2026-91791, also allows for remote code execution but stems from a different underlying flaw: the lack of validation for object existence before operations. While both require user interaction, this advisory highlights a new specific mechanism for exploitation.