# CVE-2026-91804: Foxit PDF Editor and Reader heap overflow in Circle annotation rendering

Source: https://junglewise.ai/threats/cve-2026-91804-a-heap-based-out-of-bounds-write-vulnerability-exists-in-foxit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91804 · Severity: high · CVSS 7.8 · Published 2026-09-23

Foxit PDF Editor and Reader are widely used applications for creating, editing, and viewing PDF documents in business and personal workflows. A flaw in how these products render Circle annotations in specially crafted PDF files can cause memory corruption and application crashes, potentially leading to code execution if an attacker crafts a malicious PDF and tricks a user into opening it.

Technologies: [Foxit PDF Editor](https://junglewise.ai/threats/technologies/pdf-editor), [Foxit PDF Reader](https://junglewise.ai/threats/technologies/pdf-reader). Vendors: [Foxit](https://junglewise.ai/threats/vendors/foxit).

## Quick answers

**Is CVE-2026-91804 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91804 being exploited in the wild.

**How severe is CVE-2026-91804?** High severity, with a CVSS score of 7.8, published 23 September 2026.

**Which products and versions are affected?** Foxit PDF Editor 2026.2.0.39747 and earlier 2026.x; 2025.3.0.35737 and earlier 2025.x; 2024.4.1.27687 and earlier 2024.x; 2023.3.0.23028 and earlier 2023.x; 14.0.7.33751 and earlier 14.x; 13.2.6.24111 and earlier; Foxit PDF Reader 2026.2.0.39747 and earlier.

**Is there a fix for CVE-2026-91804?** A patch was published on 2026-09-23: Fixed in Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1/14.0.8 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91804 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-91804?** Check whether you run Foxit PDF Editor or Foxit PDF Reader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based out-of-bounds write vulnerability exists in the rendering of Circle annotations with malformed Cloudy appearance streams, stemming from insufficient validation of appearance geometry. The vulnerability is triggered when a user opens a specially crafted PDF file, requiring no authentication or special privileges; successful exploitation can result in memory corruption, application crash, or arbitrary code execution with the privileges of the user.

## Affected products

- Foxit PDF Reader 2026.2.0.39747 and earlier
- Foxit PDF Editor 2026.2.0.39747 and earlier 2026.x; 2025.3.0.35737 and earlier 2025.x; 2024.4.1.27687 and earlier 2024.x; 2023.3.0.23028 and earlier 2023.x; 14.0.7.33751 and earlier 14.x; 13.2.6.24111 and earlier

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1/14.0.8 and later

## References

- [https://www.foxit.com/support/security-bulletins.html](https://www.foxit.com/support/security-bulletins.html)

## Related threats

- [Foxit PDF Editor use-after-free in JavaScript annotation handling](https://junglewise.ai/threats/cve-2026-91818-a-use-after-free-vulnerability-exists-in-foxit-pdf-editor-reader)
- [Foxit PDF Editor heap-based out-of-bounds read in JavaScript string handling](https://junglewise.ai/threats/cve-2026-91817-a-heap-based-out-of-bounds-read-vulnerability-exists-in-foxit-pdf)
- [Foxit PDF Editor use-after-free in annotation handling](https://junglewise.ai/threats/cve-2026-91816-a-use-after-free-vulnerability-exists-in-foxit-pdf-editor-reader)
- [Foxit PDF Editor/Reader out-of-bounds write in JPEG2000 decoding](https://junglewise.ai/threats/cve-2026-91815-foxit-pdf-editor-reader-does-not-perform-sufficient-verification)
- [Foxit PDF Editor and Reader signature validation bypass in incremental updates](https://junglewise.ai/threats/cve-2026-91814-a-signature-validation-vulnerability-exists-in-foxit-pdf-editor)