Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-91802

Foxit PDF Editor/Reader — Heap Buffer Overflow in WebP Image Decoding via Bitmap Stride Confusion

CVSS 3.1 7.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-91802

Published

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-91802

Published

Foxit PDF Editor

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Foxit Software Inc.",
                    "product": "Foxit PDF Editor",
                    "platforms": [
                        "Windows"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "Versions 2026.2 and earlier"
                        },
                        {
                            "status": "affected",
                            "version": "Versions 14.0.7 and earlier"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Foxit PDF Reader

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Foxit Software Inc.",
                    "product": "Foxit PDF Reader",
                    "platforms": [
                        "Windows"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "Versions 2026.2 and earlier"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON