CVE-2026-91807
MEDIUM 6.1A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.1%chance of exploitation in 30 days · 1st percentile
Impact if exploited
6.1CVSS 3.1 · MEDIUM
- ConfidentialityLow
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
- github-search Search GitHub for public PoC repos
Test against your own equipment
curl -s https://vulnpedia.com/cve/CVE-2026-91807/poc.jsonMachine-readable PoC index for this CVE (for automation).Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-91807/poc.json
Affected
Vendors Foxit Software Inc. Foxit Microsoft Apple
Products Foxit Pdf Editor Foxit Pdf Reader Pdf Editor Pdf Reader Windows Macos
Weakness (CWE)
- CWE-125: Out-of-bounds Read (CWE-125)
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Foxit | Pdf Editor | ≤ 13.2.5.63482 |
| Foxit | Pdf Editor | ≥ 14.0.0.33046 and ≤ 14.0.7.33751 |
| Foxit | Pdf Editor | ≥ 2023.1.0.15510 and ≤ 2023.3.0.23028 |
| Foxit | Pdf Editor | ≥ 2024.1.0.23997 and ≤ 2024.4.1.27687 |
| Foxit | Pdf Editor | ≥ 2025.1.0.27937 and ≤ 2025.3.0.35737 |
| Foxit | Pdf Editor | ≥ 2026.1.0.36452 and ≤ 2026.2.0.39747 |
| Foxit | Pdf Reader | ≤ 2026.2.0.39747 |
| Foxit | Pdf Editor | ≤ 13.2.2.63349 |
| Foxit | Pdf Editor | ≥ 14.0.0.68868 and ≤ 14.0.7.69441 |
| Foxit | Pdf Editor | ≥ 2023.1.0.55583 and ≤ 2023.3.0.63083 |
| Foxit | Pdf Editor | ≥ 2024.1.0.63682 and ≤ 2024.4.1.66479 |
| Foxit | Pdf Editor | ≥ 2025.1.0.66692 and ≤ 2025.3.0.69570 |
| Foxit | Pdf Editor | ≥ 2026.1.0.70169 and ≤ 2026.2.0.72029 |
| Foxit | Pdf Reader | ≤ 2026.2.1.39815 |
All CVSS metrics
- MEDIUM 6.1 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - MEDIUM 6.1 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H