Foxit vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-91818 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations.High 7.8 · Sep 23, 2026
• CVE-2026-91816 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations.High 7.8 · Sep 23, 2026
• CVE-2026-91815 Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap High 7.8 · Sep 23, 2026
• CVE-2026-91813 A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insuHigh 8.8 · Sep 23, 2026
• CVE-2026-91812 A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, High 7.9 · Sep 23, 2026
• CVE-2026-91811 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fanHigh 7.8 · Sep 23, 2026
• CVE-2026-91809 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields.High 7.8 · Sep 23, 2026
• CVE-2026-91806 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields.High 7.8 · Sep 23, 2026
• CVE-2026-91805 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling.High 7.8 · Sep 23, 2026
• CVE-2026-91804 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in sHigh 7.8 · Sep 23, 2026
• CVE-2026-91803 A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writableHigh 8.8 · Sep 23, 2026
• CVE-2026-91802 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffHigh 7.8 · Sep 23, 2026
• CVE-2026-91801 A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources.High 7.8 · Sep 23, 2026
• CVE-2026-91800 A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuratiHigh 8.8 · Sep 23, 2026
• CVE-2026-91799 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects.High 7.8 · Sep 23, 2026
• CVE-2026-91798 A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the coHigh 8.8 · Sep 23, 2026
• CVE-2026-91797 Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be writtenHigh 7.8 · Sep 23, 2026
• CVE-2026-91795 Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files.High 7.8 · Sep 23, 2026
• CVE-2026-91794 An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation whenHigh 7.8 · Sep 23, 2026
• CVE-2026-91793 When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data.High 7.8 · Sep 23, 2026
• CVE-2026-91792 When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScripHigh 7.8 · Sep 23, 2026
• CVE-2026-91791 When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibHigh 7.8 · Sep 23, 2026
• CVE-2026-91790 When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed.High 7.8 · Sep 23, 2026
• CVE-2026-91789 Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information.High 7.8 · Sep 23, 2026
• CVE-2026-18597 The PDF creation feature of Foxit PDF Services API supports referencing external files.High 8.5 · Aug 6, 2026