Description
A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash.
Published: 2026-09-23
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption
Action: Apply Patch
AI Analysis

Impact

A heap-based out-of-bounds write vulnerability in the PRC parser of Foxit PDF Editor/Reader enables an attacker to trigger memory corruption by supplying a malicious PDF with improperly validated vertex indices. The flaw can lead to application crashes.

Affected Systems

The vulnerability affects Foxit PDF Editor and Foxit PDF Reader. No specific version information is provided for the affected releases.

Risk and Exploitability

The CVSS score of 7.8 classifies this issue as high severity, while the EPSS score below 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Because the flaw manifests when processing malicious PDF documents, the likely attack vector is a remote user providing a crafted file, making remediation priority for systems that open PDFs from untrusted sources.

Generated by OpenCVE AI on September 23, 2026 at 15:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Foxit PDF Editor or Reader update that contains the PRC parser security fix.
  • Configure the application to disable PRC file handling or enable a safe mode that prevents loading triangulated meshes.
  • Validate or sandbox PDF files from external sources before opening, or use an antivirus scanner that checks for malicious PDF content.

Generated by OpenCVE AI on September 23, 2026 at 15:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader
Vendors & Products Foxitsoftware
Foxitsoftware foxit Pdf Editor
Foxitsoftware foxit Reader

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash.
Title Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Foxitsoftware Foxit Pdf Editor Foxit Reader
cve-icon MITRE

Status: PUBLISHED

Assigner: Foxit

Published:

Updated: 2026-09-23T14:39:49.026Z

Reserved: 2026-09-15T07:34:45.815Z

Link: CVE-2026-91811

cve-icon Vulnrichment

Updated: 2026-09-23T14:39:45.491Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T08:17:13.307

Modified: 2026-09-23T17:58:26.570

Link: CVE-2026-91811

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T09:14:23Z

Weaknesses