Foxit Software Inc. Foxit PDF Reader vulnerabilities, page 2
80 vulnerabilities
Known vulnerabilities in Foxit Software Inc. Foxit PDF Reader, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-91804foxit software inc.foxit pdf editor+3
EPSS score0.12%
A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in specially crafted PDF files. Insufficient validation of the appearance geometry can result in memory corruption and application crashes.CVE-2026-91796foxit software inc.foxit pdf editor+3EPSS score0.12%
The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials.CVE-2026-91810foxit software inc.foxit pdf editor+3EPSS score0.11%
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash.CVE-2026-91795foxit software inc.foxit pdf editor+3EPSS score0.08%
Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution.CVE-2026-91815foxit software inc.foxit pdf editor+3EPSS score0.13%
Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution.CVE-2026-91792foxit software inc.foxit pdf editor+3EPSS score0.13%
When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition and an application crash.CVE-2026-91814foxit software inc.foxit pdf editor+1EPSS score0.11%
A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed.CVE-2026-91813foxit software inc.foxit pdf editor+3EPSS score0.09%
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges.CVE-2026-91808foxit software inc.foxit pdf editor+3EPSS score0.11%
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash.CVE-2026-91805foxit software inc.foxit pdf editor+3EPSS score0.12%
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash.CVE-2026-91798foxit software inc.foxit pdf editor+1EPSS score0.10%
A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges.CVE-2026-91809foxit software inc.foxit pdf editor+3EPSS score0.12%
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.CVE-2026-91812foxit software inc.foxit pdf editor+3EPSS score0.14%
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges.CVE-2026-91807foxit software inc.foxit pdf editor+3EPSS score0.11%
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.CVE-2026-91797foxit software inc.foxit pdf editor+3EPSS score0.21%
Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.CVE-2026-91791foxit software inc.foxit pdf editor+3EPSS score0.14%
When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash.CVE-2026-91799foxit software inc.foxit pdf editor+3EPSS score0.13%
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.CVE-2026-91788foxit software inc.foxit pdf editor+1EPSS score0.10%
When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.CVE-2026-13128foxit software inc.foxit pdf editor+3EPSS score0.17%
Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.CVE-2026-13127foxit software inc.foxit pdf editor+3EPSS score0.17%
The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnails still use the invalid page objects, ultimately causing the application to crash.