# CVE-2026-91810: Foxit PDF Reader heap out-of-bounds read in image mask handling

Source: https://junglewise.ai/threats/cve-2026-91810-a-heap-based-out-of-bounds-read-vulnerability-exists-in-foxit-pdf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91810 · Severity: medium · CVSS 6.1 · Published 2026-09-23

Foxit PDF Reader and PDF Editor applications contain a heap-based memory vulnerability triggered by specially crafted PDF files with malformed image masks. An attacker can exploit this by sending a malicious PDF that causes the application to read memory outside its intended bounds, crashing the application or potentially disclosing sensitive data from memory.

Technologies: [Foxit PDF Editor](https://junglewise.ai/threats/technologies/pdf-editor), [Foxit PDF Reader](https://junglewise.ai/threats/technologies/pdf-reader). Vendors: [Foxit](https://junglewise.ai/threats/vendors/foxit).

## Quick answers

**Is CVE-2026-91810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91810 being exploited in the wild.

**How severe is CVE-2026-91810?** Medium severity, with a CVSS score of 6.1, published 23 September 2026.

**Which products and versions are affected?** Foxit PDF Editor 2026.2.0.39747 and earlier (2026.x), 2025.3.0.35737 and earlier (2025.x), 2024.4.1.27687 and earlier (2024.x), 2023.3.0.23028 and earlier (2023.x), 14.0.7.33751 and earlier (14.x), 13.2.6.24111 and earlier (13.x); Foxit PDF Reader 2026.2.0.39747 and earlier.

**Is there a fix for CVE-2026-91810?** A patch was published on 2026-09-23: Foxit PDF Reader 2026.2.1 and PDF Editor 2026.2.1/14.0.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91810 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-91810?** Check whether you run Foxit PDF Editor or Foxit PDF Reader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based out-of-bounds read vulnerability exists in the PDF rendering engine's image mask handling code. The vulnerability occurs due to inconsistent validation of image metadata, causing incorrect alpha-channel processing during PDF rendering that reads beyond allocated heap memory. This is triggered by opening a malicious PDF file and can result in information disclosure or denial of service.

## Affected products

- Foxit PDF Reader 2026.2.0.39747 and earlier
- Foxit PDF Editor 2026.2.0.39747 and earlier (2026.x), 2025.3.0.35737 and earlier (2025.x), 2024.4.1.27687 and earlier (2024.x), 2023.3.0.23028 and earlier (2023.x), 14.0.7.33751 and earlier (14.x), 13.2.6.24111 and earlier (13.x)

## Timeline

- 2026-09-23: disclosed: CVE-2026-91810 publicly disclosed; patched versions released
- 2026-09-23: patched: Foxit PDF Reader 2026.2.1 and PDF Editor 2026.2.1/14.0.8 released

## References

- [https://www.foxit.com/support/security-bulletins.html](https://www.foxit.com/support/security-bulletins.html)

## Related threats

- [Foxit PDF Editor use-after-free in JavaScript annotation handling](https://junglewise.ai/threats/cve-2026-91818-a-use-after-free-vulnerability-exists-in-foxit-pdf-editor-reader)
- [Foxit PDF Editor heap-based out-of-bounds read in JavaScript string handling](https://junglewise.ai/threats/cve-2026-91817-a-heap-based-out-of-bounds-read-vulnerability-exists-in-foxit-pdf)
- [Foxit PDF Editor use-after-free in annotation handling](https://junglewise.ai/threats/cve-2026-91816-a-use-after-free-vulnerability-exists-in-foxit-pdf-editor-reader)
- [Foxit PDF Editor/Reader out-of-bounds write in JPEG2000 decoding](https://junglewise.ai/threats/cve-2026-91815-foxit-pdf-editor-reader-does-not-perform-sufficient-verification)
- [Foxit PDF Editor and Reader signature validation bypass in incremental updates](https://junglewise.ai/threats/cve-2026-91814-a-signature-validation-vulnerability-exists-in-foxit-pdf-editor)