Is CVE-2026-91810 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91810 being exploited in the wild.

How severe is CVE-2026-91810?

Medium severity, with a CVSS score of 6.1, published 23 September 2026.

Which products and versions are affected?

Foxit PDF Editor 2026.2.0.39747 and earlier (2026.x), 2025.3.0.35737 and earlier (2025.x), 2024.4.1.27687 and earlier (2024.x), 2023.3.0.23028 and earlier (2023.x), 14.0.7.33751 and earlier (14.x), 13.2.6.24111 and earlier (13.x); Foxit PDF Reader 2026.2.0.39747 and earlier.

Is there a fix for CVE-2026-91810?

A patch was published on 2026-09-23: Foxit PDF Reader 2026.2.1 and PDF Editor 2026.2.1/14.0.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91810 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-91810?

Check whether you run Foxit PDF Editor or Foxit PDF Reader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91810: Foxit PDF Reader heap out-of-bounds read in image mask handling

CVE-2026-91810 · Severity: medium · CVSS 6.1 · Published 2026-09-23

Foxit PDF Reader and PDF Editor applications contain a heap-based memory vulnerability triggered by specially crafted PDF files with malformed image masks. An attacker can exploit this by sending a malicious PDF that causes the application to read memory outside its intended bounds, crashing the application or potentially disclosing sensitive data from memory.

Technologies: Foxit PDF Editor, Foxit PDF Reader. Vendors: Foxit.

Quick answers

Is CVE-2026-91810 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91810 being exploited in the wild.
How severe is CVE-2026-91810?: Medium severity, with a CVSS score of 6.1, published 23 September 2026.
Which products and versions are affected?: Foxit PDF Editor 2026.2.0.39747 and earlier (2026.x), 2025.3.0.35737 and earlier (2025.x), 2024.4.1.27687 and earlier (2024.x), 2023.3.0.23028 and earlier (2023.x), 14.0.7.33751 and earlier (14.x), 13.2.6.24111 and earlier (13.x); Foxit PDF Reader 2026.2.0.39747 and earlier.
Is there a fix for CVE-2026-91810?: A patch was published on 2026-09-23: Foxit PDF Reader 2026.2.1 and PDF Editor 2026.2.1/14.0.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91810 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-91810?: Check whether you run Foxit PDF Editor or Foxit PDF Reader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based out-of-bounds read vulnerability exists in the PDF rendering engine's image mask handling code. The vulnerability occurs due to inconsistent validation of image metadata, causing incorrect alpha-channel processing during PDF rendering that reads beyond allocated heap memory. This is triggered by opening a malicious PDF file and can result in information disclosure or denial of service.

Affected products

Foxit PDF Reader 2026.2.0.39747 and earlier
Foxit PDF Editor 2026.2.0.39747 and earlier (2026.x), 2025.3.0.35737 and earlier (2025.x), 2024.4.1.27687 and earlier (2024.x), 2023.3.0.23028 and earlier (2023.x), 14.0.7.33751 and earlier (14.x), 13.2.6.24111 and earlier (13.x)

Timeline

2026-09-23: disclosed: CVE-2026-91810 publicly disclosed; patched versions released
2026-09-23: patched: Foxit PDF Reader 2026.2.1 and PDF Editor 2026.2.1/14.0.8 released

References

https://www.foxit.com/support/security-bulletins.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.