CVE-2026-91817: 
Foxit PDF Reader vulnerability analysis and mitigation

CVE-2026-91817 is a heap-based out-of-bounds read vulnerability in Foxit PDF Editor and Foxit PDF Reader affecting their handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges causes an integer underflow, leading to an out-of-bounds read and application crash. Affected versions include Foxit PDF Editor 13.2.6 and earlier, 14.0.7 and earlier, and 2026.2 and earlier; Foxit PDF Reader 2026.2 and earlier. The vulnerability was published on September 23, 2026, with a patch available as of that date. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Foxit Security Bulletins).

The root cause is classified as CWE-125 (Out-of-bounds Read), triggered by insufficient validation of string-deletion ranges when processing wide strings within embedded PDF JavaScript. When a maliciously crafted PDF containing specially formed JavaScript string operations is opened, the application fails to properly validate the deletion range parameters, causing an integer underflow that results in a heap-based read beyond the intended buffer boundary. Exploitation requires local access and user interaction — specifically, a victim must open a crafted PDF file — and no privileges are required on the part of the attacker. No public proof-of-concept code has been identified (GitHub Advisory, Foxit Security Bulletins).

Successful exploitation can result in limited memory disclosure (low confidentiality impact) and application crash (high availability impact), with no integrity impact. An attacker who tricks a user into opening a malicious PDF can cause Foxit PDF Editor or Reader to read sensitive data from heap memory and terminate abnormally, constituting a denial-of-service condition. The scope is limited to the affected application and does not extend to other system components, and there is no evidence of lateral movement potential (GitHub Advisory, Foxit Security Bulletins).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for CVE-2026-91817. The EPSS score is approximately 0.107% (1st percentile), indicating a low probability of exploitation in the near term. The NVD SSVC assessment classifies exploitation as "none" and the technical impact as "partial." The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Foxit Security Bulletins).

Foxit has released patches addressing this vulnerability. Users should update to a version later than the following fixed thresholds: Foxit PDF Editor 13.2.6, 14.0.7, or 2026.2 (depending on the installed edition), and Foxit PDF Reader 2026.2. As a temporary workaround prior to patching, organizations should restrict user access to PDF files from untrusted or unknown sources. Patches are available via the Foxit security bulletins page (Foxit Security Bulletins, GitHub Advisory).