Is CVE-2026-91818 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91818 being exploited in the wild.

How severe is CVE-2026-91818?

High severity, with a CVSS score of 7.8, published 23 September 2026.

Which products and versions are affected?

Foxit PDF Editor 2026.2.0.39747 and earlier, 2025.x through 2025.3.0.35736, 2024.x through 2024.4.1.27686, 2023.x through 2023.3.0.23027, 14.x through 14.0.7.33751, 13.2.6.24111 and earlier; Foxit PDF Reader 2026.2.0.39747 and earlier.

Is there a fix for CVE-2026-91818?

A patch was published on 2026-09-23: Fixed in PDF Reader 2026.2.1, PDF Editor 2026.2.1/14.0.8 and later versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91818 attacked?

It is attacked with local access.

Am I affected by CVE-2026-91818?

Check whether you run Foxit PDF Editor or Foxit PDF Reader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91818: Foxit PDF Editor use-after-free in JavaScript annotation handling

CVE-2026-91818 · Severity: high · CVSS 7.8 · Published 2026-09-23

Foxit PDF Editor and Reader contain a use-after-free vulnerability in their JavaScript engine when processing PDF annotations. An attacker who crafts a malicious PDF with reentrant page-event code can trigger an application crash. While this does not enable code execution, it allows denial of service against users opening untrusted PDF files.

Technologies: Foxit PDF Editor, Foxit PDF Reader. Vendors: Foxit.

Quick answers

Is CVE-2026-91818 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91818 being exploited in the wild.
How severe is CVE-2026-91818?: High severity, with a CVSS score of 7.8, published 23 September 2026.
Which products and versions are affected?: Foxit PDF Editor 2026.2.0.39747 and earlier, 2025.x through 2025.3.0.35736, 2024.x through 2024.4.1.27686, 2023.x through 2023.3.0.23027, 14.x through 14.0.7.33751, 13.2.6.24111 and earlier; Foxit PDF Reader 2026.2.0.39747 and earlier.
Is there a fix for CVE-2026-91818?: A patch was published on 2026-09-23: Fixed in PDF Reader 2026.2.1, PDF Editor 2026.2.1/14.0.8 and later versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91818 attacked?: It is attacked with local access.
Am I affected by CVE-2026-91818?: Check whether you run Foxit PDF Editor or Foxit PDF Reader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability occurs in Foxit's JavaScript handling during annotation enumeration, where reentrant page-event processing may release the underlying page object while it is still in use. The use-after-free leads to memory corruption and application crash. Exploitation requires user interaction (opening a crafted PDF) and does not require network or local privileges; a patch is available in versions 2026.2.1, 2025.3.0.35737+, 2024.4.1.27687+, 2023.3.0.23028+, 14.0.8+, and 13.2.6.24111+.

Affected products

Foxit PDF Editor 2026.2.0.39747 and earlier, 2025.x through 2025.3.0.35736, 2024.x through 2024.4.1.27686, 2023.x through 2023.3.0.23027, 14.x through 14.0.7.33751, 13.2.6.24111 and earlier
Foxit PDF Reader 2026.2.0.39747 and earlier

Timeline

2026-09-23: disclosed: CVE-2026-91818 publicly disclosed
2026-09-23: patched: Fixed in PDF Reader 2026.2.1, PDF Editor 2026.2.1/14.0.8 and later versions

References

https://www.foxit.com/support/security-bulletins.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.