CVE-2026-91814 Foxit CVE debrief

Who should care

Defenders, security teams, and IT administrators responsible for managing and securing Foxit PDF Editor and Reader installations should assess exposure and prioritize verification and updates.

Why it matters

The signature validation vulnerability in Foxit PDF Editor/Reader allows attackers to alter signed content and potentially carry out content spoofing. Defenders should prioritize verifying and updating Foxit PDF Editor and Reader, assessing exposure, and implementing compensating controls.

• Content spoofing may occur, allowing attackers to alter signed content
• Visibility and reputation may be impacted if attackers manipulate document content
• Defenders must verify and update Foxit PDF Editor and Reader to prevent exploitation
• Incident response plans should be reviewed and updated to address potential content spoofing incidents

Technical summary

The vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed. This signature validation vulnerability allows attackers to manipulate signed content, potentially leading to content spoofing. Defenders should prioritize verifying and updating Foxit PDF Editor and Reader to the latest versions, assessing exposure in their environments.

Defensive priority

Defenders should prioritize verifying and updating Foxit PDF Editor and Reader to the latest versions, assessing exposure in their environments, and implementing compensating controls to detect and prevent content spoofing.

Recommended defensive actions

• Verify and update Foxit PDF Editor and Reader to the latest versions
• Assess exposure in environments
• Implement compensating controls to detect and prevent content spoofing
• Monitor for suspicious activity
• Review and update incident response plans

Evidence notes

The CVE record and NVD vulnerability detail provide information on the signature validation vulnerability in Foxit PDF Editor/Reader. The vendor advisory provides additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.