CVE-2026-91815: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2026-91815 is a heap buffer out-of-bounds write vulnerability in Foxit PDF Editor and Foxit PDF Reader caused by insufficient verification of JPEG2000 image metadata embedded in PDF files. During JPEG2000 image decoding, the lack of proper metadata validation can lead to a heap buffer overflow, potentially causing application crashes or enabling arbitrary code execution. Affected products include Foxit PDF Editor (versions 13.2.6 and earlier, 14.0.7 and earlier, and 2026.2 and earlier) and Foxit PDF Reader (versions 2026.2 and earlier). The vulnerability was published on September 23, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Foxit Security Bulletins).

The root cause is classified as CWE-787 (Out-of-bounds Write): Foxit PDF Editor/Reader fails to adequately validate JPEG2000 image metadata fields within PDF files before using them to control heap buffer write operations during decoding. An attacker can craft a malicious PDF containing specially formed JPEG2000 metadata that, when processed by the decoder, causes a write operation to exceed the bounds of the allocated heap buffer. Exploitation requires local access and user interaction — specifically, a victim must open a maliciously crafted PDF file — but no privileges are required on the part of the attacker (GitHub Advisory, Foxit Security Bulletins).

Successful exploitation can result in high impacts to confidentiality, integrity, and availability. An attacker who tricks a user into opening a malicious PDF can crash the Foxit application (denial of service) or, in more severe cases, achieve arbitrary code execution with the privileges of the user running the affected software. This could allow an attacker to access sensitive data, modify files, or use the compromised session as a foothold for further lateral movement within the victim's environment (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.185% (roughly the 2nd percentile), indicating a low near-term probability of exploitation. Exploitation is not automatable, as it requires user interaction (opening a crafted PDF), which limits mass exploitation potential (GitHub Advisory).

1. Craft malicious PDF: Create a PDF file containing a JPEG2000 image stream with specially crafted metadata (e.g., manipulated image dimensions, tile sizes, or component parameters) designed to trigger an out-of-bounds write during heap buffer allocation and decoding in Foxit's JPEG2000 parser.
2. Deliver the payload: Distribute the malicious PDF to the target via phishing email, malicious download link, or other social engineering methods, since user interaction is required.
3. Trigger decoding: When the victim opens the PDF in a vulnerable version of Foxit PDF Editor or Reader (≤2026.2, ≤14.0.7, or ≤13.2.6), the application attempts to decode the embedded JPEG2000 image.
4. Exploit heap corruption: The insufficient metadata verification causes the decoder to write data beyond the intended heap buffer boundary, corrupting adjacent heap memory.
5. Achieve code execution or crash: Depending on heap layout and exploitation technique, the attacker may achieve arbitrary code execution with the privileges of the victim user, or at minimum cause the application to crash (GitHub Advisory, Foxit Security Bulletins).

• Process: Unexpected child processes spawned by Foxit PDF Editor or Reader (e.g., cmd.exe, powershell.exe, sh, curl, wget) following the opening of a PDF file.
• File System: Unusual files written to temp directories or the user's profile by the Foxit process shortly after opening a PDF; unexpected executables or scripts created in %TEMP% or %APPDATA%.
• Logs: Application crash logs or Windows Error Reporting (WER) entries referencing Foxit PDF Editor/Reader with heap corruption or access violation exceptions; Event Log entries showing abnormal process creation from Foxit binaries.
• Network: Unexpected outbound network connections originating from the Foxit PDF Editor or Reader process to external IP addresses following PDF file opening.

Foxit Software has released patches addressing this vulnerability. Users should upgrade Foxit PDF Reader and Foxit PDF Editor to versions beyond 2026.2, 14.0.7, and 13.2.6 respectively, as indicated in the security bulletin (Foxit Security Bulletins, GitHub Advisory). As interim mitigations, users should exercise caution when opening PDF files from untrusted or unknown sources, and organizations may consider implementing application sandboxing or whitelisting to limit the impact of potential code execution. Monitoring Foxit application processes for anomalous child process creation is also recommended.