Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-91790

Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability

CVSS 3.1 7.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-91790

Published

When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed. As a result, the program may access an already-freed internal data structure, triggering a crash due to UAF.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-91790

Published

Foxit PDF Editor

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Foxit Software Inc.",
                    "product": "Foxit PDF Editor",
                    "platforms": [
                        "Windows"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "Versions 2026.2 and earlier"
                        },
                        {
                            "status": "affected",
                            "version": "Versions 14.0.7 and earlier"
                        },
                        {
                            "status": "affected",
                            "version": "Versions 13.2.6 and earlier"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Foxit PDF Reader

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Foxit Software Inc.",
                    "product": "Foxit PDF Reader",
                    "platforms": [
                        "Windows"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "Versions 2026.2 and earlier"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON