FoxitCVE-2026-91808
Foxit PDF: out-of-bounds read
Medium6.1CVE-2026-91808 · Published Sep 23, 2026
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Foxit PDF Editor Product | <= Versions 2026.2 and earlier | No fix yet |
| <= Versions 14.0.7 and earlier | No fix yet | |
| <= Versions 13.2.6 and earlier | No fix yet | |
| Foxit PDF Reader Product | <= Versions 2026.2 and earlier | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-125
More Foxit advisories
All Foxit| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 23 | Foxit PDF: out-of-bounds read | Medium6.1 | No fix yet |
| Sep 23 | Foxit PDF: use after free | High7.8 | No fix yet |
| Sep 23 | Foxit PDF: use after free | High7.8 | No fix yet |
| Sep 23 | Foxit PDF: out-of-bounds read | Medium6.1 | No fix yet |
| Sep 23 | Foxit PDF: out-of-bounds write | High7.8 | No fix yet |
| Sep 23 | Foxit PDF: code execution | High7.9 | No fix yet |