CVE-2026-91788

MediumCVSS 4.7/10Last modified Sep 23, 2026

Description

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-668

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Sep 23, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-917897.8Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information. CVE-2026-91797.5The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST enCVE-2026-917907.8When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are maCVE-2026-917917.8When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triCVE-2026-917927.8When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotatiCVE-2026-917937.8When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malforCVE-2026-917947.8An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and bounCVE-2026-917957.8Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This couldCVE-2026-917966.1The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to tCVE-2026-917977.8Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments beinCVE-2026-917988.8A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuratioCVE-2026-917997.8A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause t