Is CVE-2026-91809 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91809 being exploited in the wild.

How severe is CVE-2026-91809?

High severity, with a CVSS score of 7.8, published 23 September 2026.

Which products and versions are affected?

Foxit PDF Editor 2026.2.0.39747 and earlier (2026.x); 2025.3.0.35737 and earlier (2025.x); 2024.4.1.27687 and earlier (2024.x); 2023.3.0.23028 and earlier (2023.x); 14.0.7.33751 and earlier (14.x); 13.2.6.24111 and earlier; Foxit PDF Reader 2026.2.0.39747 and earlier.

Is there a fix for CVE-2026-91809?

A patch was published on 2026-09-23: Fixes available in PDF Reader 2026.2.1 and PDF Editor 2026.2.1/14.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91809 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-91809?

Check whether you run Foxit PDF Editor or Foxit PDF Reader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91809: Foxit PDF Reader use-after-free in form field handling

CVE-2026-91809 · Severity: high · CVSS 7.8 · Published 2026-09-23

Foxit PDF Reader and PDF Editor are tools used to view and edit PDF documents. A flaw in how they process malformed PDF form fields can cause the application to crash when opening a specially crafted PDF file, potentially disrupting work and serving as a precursor to more serious attacks.

Technologies: Foxit PDF Editor, Foxit PDF Reader. Vendors: Foxit.

Quick answers

Is CVE-2026-91809 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91809 being exploited in the wild.
How severe is CVE-2026-91809?: High severity, with a CVSS score of 7.8, published 23 September 2026.
Which products and versions are affected?: Foxit PDF Editor 2026.2.0.39747 and earlier (2026.x); 2025.3.0.35737 and earlier (2025.x); 2024.4.1.27687 and earlier (2024.x); 2023.3.0.23028 and earlier (2023.x); 14.0.7.33751 and earlier (14.x); 13.2.6.24111 and earlier; Foxit PDF Reader 2026.2.0.39747 and earlier.
Is there a fix for CVE-2026-91809?: A patch was published on 2026-09-23: Fixes available in PDF Reader 2026.2.1 and PDF Editor 2026.2.1/14.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91809 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-91809?: Check whether you run Foxit PDF Editor or Foxit PDF Reader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the field-name traversal logic when processing malformed PDF form fields due to insufficient validation. An attacker can trigger a crash by delivering a malicious PDF file that an unsuspecting user opens locally, exploiting improper object lifecycle management. The vulnerability has been patched in Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1 and later.

Affected products

Foxit PDF Reader 2026.2.0.39747 and earlier
Foxit PDF Editor 2026.2.0.39747 and earlier (2026.x); 2025.3.0.35737 and earlier (2025.x); 2024.4.1.27687 and earlier (2024.x); 2023.3.0.23028 and earlier (2023.x); 14.0.7.33751 and earlier (14.x); 13.2.6.24111 and earlier

Timeline

2026-09-23: disclosed: Public disclosure via NVD and Foxit security bulletin
2026-09-23: patched: Fixes available in PDF Reader 2026.2.1 and PDF Editor 2026.2.1/14.0.8

References

https://www.foxit.com/support/security-bulletins.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.