CVE-2026-91794 Foxit CVE debrief

Who should care

Defenders responsible for managing and securing PDF Editor and Reader installations, especially in environments where PDF files from untrusted sources are commonly opened, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-91794 is a high-severity vulnerability in Foxit PDF Editor/Reader that requires immediate attention from defenders. It may cause a program crash and potentially lead to remote code execution. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where PDF files from untrusted sources are commonly opened.

• Potential program crash and data loss due to exploitation.
• Possible remote code execution, allowing attackers to gain control over the system.
• Need for patching or mitigation to prevent exploitation.
• Verification of affected versions and inventory checks to ensure exposure assessment.

Technical summary

The vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data. This may cause the program to crash and potentially lead to remote code execution. The issue is related to the handling of color space data in PDF files, and defenders should prioritize patching or mitigating this vulnerability, especially in environments where PDF files from untrusted sources are commonly opened. The CVE record and NVD vulnerability detail provide additional information on the vulnerability and its potential impact.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where PDF files from untrusted sources are commonly opened.

Recommended defensive actions

• Patch or upgrade Foxit PDF Editor and Reader to a version outside of the vulnerable range.
• Implement network segmentation and isolation to limit the attack surface.
• Monitor for suspicious PDF files and restrict their opening to trusted sources.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its CVSS score, and affected versions of Foxit PDF Editor and Reader. The evidence is based on official CVE Program and NVD sources, but the exact scope of affected versions and potential impact is limited by the information available. Defenders should verify the affected versions in their environment and review vendor guidance for patching or mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.