CVE-2026-91814: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2026-91814 is a signature validation bypass vulnerability in Foxit PDF Editor and Foxit PDF Reader affecting their handling of incrementally updated PDF documents. The flaw allows attackers to alter visible content in a signed PDF without invalidating the existing digital signature, enabling content spoofing while the document continues to appear validly signed. Affected versions include Foxit PDF Editor 13.2.6 and earlier, 14.0.7 and earlier, and 2026.2 and earlier, as well as Foxit PDF Reader 2026.2 and earlier. The vulnerability was published on September 23, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Foxit Security Bulletins).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). When a PDF document is incrementally updated — a standard PDF feature that appends changes without rewriting the entire file — Foxit PDF Editor/Reader fails to properly validate whether those incremental changes affect content covered by an existing digital signature. This allows an attacker to craft a modified PDF where visible content has been altered post-signing, yet the signature validation routine still reports the document as validly signed. Exploitation requires the attacker to deliver a specially crafted PDF to a victim who then opens it in a vulnerable Foxit product (user interaction required), and the attack complexity is rated High due to the need to craft a valid incremental update that bypasses signature checks (Github Advisory).

Successful exploitation results in a high integrity impact: an attacker can present a document with falsified visible content (e.g., altered contract terms, financial figures, or legal language) while the digital signature indicator shows the document as authentic and unmodified. There is no confidentiality or availability impact. The primary risk is content spoofing and fraud — recipients relying on the signature validity indicator may be deceived into trusting tampered documents, with potential consequences in legal, financial, or regulatory contexts (Github Advisory, Foxit Security Bulletins).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the attack is not automatable, requiring user interaction. The EPSS score is approximately 0.17% (roughly 1st percentile), indicating a low near-term probability of exploitation. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Craft a signed PDF: Obtain or create a legitimately signed PDF document containing content the attacker wishes to spoof (e.g., a contract or invoice).
2. Apply incremental update: Using PDF manipulation tools (e.g., custom scripts or PDF libraries such as PyMuPDF or iText), append an incremental update to the PDF that modifies visible content (e.g., alters text, numbers, or images) without touching the signed byte range.
3. Verify bypass: Open the modified PDF in a vulnerable version of Foxit PDF Editor or Reader and confirm that the signature validation indicator still shows the document as validly signed despite the content change.
4. Deliver to target: Send the crafted PDF to the intended victim via email, file share, or other delivery mechanism.
5. Victim opens document: The victim opens the PDF in a vulnerable Foxit product, sees the falsified content alongside a valid signature indicator, and may act on the fraudulent information believing the document is authentic (Github Advisory).

• File System: PDF files with multiple incremental update sections (multiple %%EOF markers or xref tables) where the signed byte range does not cover the full file — detectable via PDF forensic tools such as pdfid or pdf-parser.
• File System: Unexpected discrepancies between the visible content of a signed PDF and the content covered by the cryptographic signature byte range.
• Logs: Foxit PDF Editor/Reader application logs showing signature validation events on documents with incremental updates that extend beyond the signed byte range.
• Network: Receipt of PDF attachments from unexpected or external senders, particularly in contexts where signed documents are used for legal or financial transactions.

Foxit Software has released patches addressing this vulnerability. Users should update Foxit PDF Editor to a version newer than 13.2.6, 14.0.7, or 2026.2 (depending on the installed branch), and update Foxit PDF Reader to a version newer than 2026.2. Until patching is complete, organizations should exercise heightened caution when relying on signature validity indicators in Foxit products and verify document authenticity through alternative channels (e.g., re-requesting the document directly from the signer) before acting on signed PDFs (Foxit Security Bulletins, Github Advisory).