CVE-2026-91807
published 2026-09-23CVE-2026-91807: A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the…
PriorityP422medium6.1CVSS 3.1
AVLACLPRNUIRSUCLINAH
EPSS
0.11%
1.1th percentile
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| foxit | pdf_editor | <= 13.2.5.63482 | — |
| foxit | pdf_editor | <= 13.2.2.63349 | — |
| foxit | pdf_editor | 14.0.0.33046 – 14.0.7.33751 | — |
| foxit | pdf_editor | 14.0.0.68868 – 14.0.7.69441 | — |
| foxit | pdf_editor | 2023.1.0.15510 – 2023.3.0.23028 | — |
| foxit | pdf_editor | 2023.1.0.55583 – 2023.3.0.63083 | — |
| foxit | pdf_editor | 2024.1.0.23997 – 2024.4.1.27687 | — |
| foxit | pdf_editor | 2024.1.0.63682 – 2024.4.1.66479 | — |
| foxit | pdf_editor | 2025.1.0.27937 – 2025.3.0.35737 | — |
| foxit | pdf_editor | 2025.1.0.66692 – 2025.3.0.69570 | — |
| foxit | pdf_editor | 2026.1.0.36452 – 2026.2.0.39747 | — |
| foxit | pdf_editor | 2026.1.0.70169 – 2026.2.0.72029 | — |
| foxit | pdf_reader | <= 2026.2.0.39747 | — |
| foxit | pdf_reader | <= 2026.2.1.39815 | — |
| foxit_software_inc | foxit_pdf_editor | — | — |
| foxit_software_inc | foxit_pdf_editor | — | — |
| foxit_software_inc | foxit_pdf_editor | — | — |
| foxit_software_inc | foxit_pdf_reader | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-23
Published