CVE-2026-91816: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2026-91816 is a use-after-free (UAF) vulnerability in Foxit PDF Editor and Foxit PDF Reader's handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been freed, resulting in a UAF condition and potential application crash or code execution. Affected products include Foxit PDF Editor versions 13.2.6 and earlier, 14.0.7 and earlier, and 2026.2 and earlier, as well as Foxit PDF Reader versions 2026.2 and earlier. The vulnerability was published on September 23, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Foxit Security Bulletins).

The vulnerability is classified as CWE-416 (Use After Free). It arises in Foxit PDF Editor/Reader's annotation handling subsystem, where embedded JavaScript within a PDF document can trigger reentrant deletion of an annotation object. When the application subsequently attempts to access the already-freed annotation object, it operates on invalid memory, leading to a UAF condition. Exploitation requires a user to open a specially crafted PDF file containing malicious embedded JavaScript; no elevated privileges are required, but user interaction is necessary (GitHub Advisory, Foxit Security Bulletins).

Successful exploitation allows an unauthenticated local attacker — who tricks a user into opening a malicious PDF — to execute arbitrary code with the privileges of the Foxit application process, crash the application, or read sensitive data from application memory. The impact spans confidentiality, integrity, and availability, all rated High. The attack is confined to the local system scope, limiting direct lateral movement, but code execution under the user's context could enable further post-exploitation activity (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.17%, indicating a low near-term probability of exploitation. Exploitation is not automatable and requires user interaction (opening a malicious PDF), which reduces the overall risk compared to remotely exploitable vulnerabilities.

1. Craft malicious PDF: Create a PDF document containing embedded JavaScript that triggers reentrant deletion of a PDF annotation object — for example, using a JavaScript event handler (e.g., annot.destroy() called within a callback that itself fires during annotation processing).
2. Deliver the PDF: Distribute the crafted PDF to the target via phishing email, malicious download link, or other social engineering means.
3. User opens the PDF: The victim opens the malicious PDF in a vulnerable version of Foxit PDF Editor (≤13.2.6, ≤14.0.7, or ≤2026.2) or Foxit PDF Reader (≤2026.2).
4. Trigger UAF condition: The embedded JavaScript executes, causing reentrant annotation deletion; the application accesses the freed annotation object, triggering the use-after-free condition.
5. Achieve code execution or crash: Depending on heap state, the attacker may achieve arbitrary code execution with the privileges of the Foxit process, or cause an application crash (GitHub Advisory).

• File System: Unexpected PDF files in download directories or temporary folders with embedded JavaScript annotation manipulation logic; presence of crafted PDFs with unusual annotation structures.
• Process: Foxit PDF Editor or Reader process spawning unexpected child processes (e.g., cmd.exe, powershell.exe, sh) following PDF open events; application crashes generating crash dump files in %APPDATA% or /tmp.
• Logs: Application crash logs or Windows Event Log entries (Event ID 1000/1001) referencing FoxitPDFEditor.exe or FoxitPDFReader.exe with access violation or heap corruption errors; JavaScript execution logs within Foxit if logging is enabled.

Foxit has released patched versions addressing this vulnerability. Users should update to Foxit PDF Reader 2026.3 or later, and Foxit PDF Editor 13.2.7, 14.0.8, or 2026.3 or later depending on the major version in use (GitHub Advisory, Foxit Security Bulletins). As a workaround, users should exercise caution when opening PDF files from untrusted sources and consider disabling JavaScript execution within Foxit PDF applications (via Preferences → JavaScript → uncheck "Enable JavaScript Actions") if JavaScript is not required for their workflow.