CVE-2026-91817

Description

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash.

Overview

State: PUBLISHED
Assigner (CNA): Foxit
CVSS severity: MEDIUM
CVSS score: 6.1 / 10
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Effective score: 6.1 / 10 MEDIUM source: CNA overview
CWE(s): CWE-125
Reserved: 2026-09-15
Published: 2026-09-23 07:49 UTC
Last updated: 2026-09-23 14:22 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91817.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-23 08:17:14 UTC
NVD last modified: 2026-09-23 17:58:26 UTC
NVD CVSS v3.1: 6.1 / 10 MEDIUM source: 14984358-7092-470d-8f34-ade47a7658a2
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 4.2 / 10
EPSS score: 0.0015 (probability of exploitation in next 30 days)
EPSS percentile: 4.80% vs all CVEs — higher = more likely to be exploited, as of 2026-09-23

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85157
Assigner: Foxit
Published: Sep 23, 2026, 7:49:15 AM
Updated: Sep 23, 2026, 2:22:36 PM
EUVD base score (CVSS 3.1): 6.1 / 10
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
EUVD-reported EPSS: 0.1500
Vendors: Foxit Software Inc.
Products: Foxit PDF Editor (Versions 13.2.6 and earlier)

Foxit PDF Editor (Versions 14.0.7 and earlier)

Foxit PDF Reader (Versions 2026.2 and earlier)

Foxit PDF Editor (Versions 2026.2 and earlier)
Aliases: GHSA-pg53-55p8-5cr6

ENISA description: A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash.

EUVD references (1)

https://www.foxit.com/support/security-bulletins.html

Affected products (2)

Vendor	Product	Versions	Platforms
Foxit Software Inc.	Foxit PDF Editor	`Versions 2026.2 and earlier` (affected), `Versions 14.0.7 and earlier` (affected), `Versions 13.2.6 and earlier` (affected)	Windows
Foxit Software Inc.	Foxit PDF Reader	`Versions 2026.2 and earlier` (affected)	Windows

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://www.foxit.com/support/security-bulletins.html

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://www.foxit.com/support/security-bulletins.html 14984358-7092-470d-8f34-ade47a7658a2

Remediations (10)

CVE-2026-91718 - Vulnerability Details - OpenCVE

web:app.opencve.io

The vulnerability is a Use After Free (CWE‑416) flaw in Chrome's core code that allows an attacker to craft a freed memory reference that is later accessed, enabling code execution beyond the intended security boundaries.

2026-09-24 11:47 UTC
CVE-2026-91718 | Vulnerability Database | Aqua Security

web:avd.aquasec.com

CVE - 2026 -91718 Vulnerability, Severity 0 N/A, Use After Free

2026-09-24 11:47 UTC
CVE-2026-91817: Foxit Software Inc. Out-of-bounds Read | CVETodo

web:cvetodo.com

CVE-2026-91817 : Out-of-bounds Read in Foxit PDF Editor, Foxit PDF Reader. Full technical analysis, mitigations , and exploit status — updated in real time.

2026-09-24 11:47 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-09-24 11:47 UTC
CVE-2026-91718 - security-tracker.debian.org

web:security-tracker.debian.org

Vulnerable and fixed packages The table below lists information on source packages.

2026-09-24 11:47 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-24 11:47 UTC
Description of the security update for Office 2016: August 11, 2026 ...

web:support.microsoft.com

Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home. (See What version of Office am I using?) How to get and install the update Method 1: Microsoft Update This update is available from Microsoft Update. When you turn on ...

2026-09-24 11:47 UTC
CVE-2026-91718 - Google Chrome Use-After-Free Vulnerability…

web:vulmon.com

Google Chrome Use-After-Free Vulnerability Enables Remote Code Execution. A use-after-free flaw in Google Chrome's Core, prior to version 153..8010.47, enables…

2026-09-24 11:47 UTC
CVE-2026-62815: Patch Microsoft QUIC Remote Code Execution

web:windowsforum.com

CVE - 2026 -62815 is a patch -now advisory with an incomplete public technical description. Microsoft has confirmed the vulnerability and its remote-code-execution impact; the available evidence does not yet support stronger claims about exploitability, affected builds, active attacks, or a universal QUIC shutdown recommendation.

2026-09-24 11:47 UTC
CVE Vulnerabilities from 2026 — Full List - Strix

web:www.strix.ai

Complete list of CVE vulnerabilities from 2026 with severity scores and exploit data.

2026-09-24 11:47 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-91817.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T14:22:00.125904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T14:22:36.779Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Foxit PDF Editor",
          "vendor": "Foxit Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 2026.2 and earlier"
            },
            {
              "status": "affected",
              "version": "Versions 14.0.7 and earlier"
            },
            {
              "status": "affected",
              "version": "Versions 13.2.6 and earlier"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Foxit PDF Reader",
          "vendor": "Foxit Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 2026.2 and earlier"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anonymous working with TrendAI Zero Day Initiative"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader\u2019s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash."
            }
          ],
          "value": "A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader\u2019s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Information Disclosure"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read (CWE-125)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T07:49:15.176Z",
        "orgId": "14984358-7092-470d-8f34-ade47a7658a2",
        "shortName": "Foxit"
      },
      "references": [
        {
          "url": "https://www.foxit.com/support/security-bulletins.html"
        }
      ],
      "title": "Foxit PDF Editor/Reader AcroForm Out-of-Bounds Read Remote Code Execution Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14984358-7092-470d-8f34-ade47a7658a2",
    "assignerShortName": "Foxit",
    "cveId": "CVE-2026-91817",
    "datePublished": "2026-09-23T07:49:15.176Z",
    "dateReserved": "2026-09-15T07:34:45.816Z",
    "dateUpdated": "2026-09-23T14:22:36.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}