PT-2026-97221

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A heap-based out-of-bounds write occurs during WebP image decoding due to improper handling of bitmap stride and target buffer formats. This issue can lead to an application...

CVE-2026-91808: Out-of-bounds Read

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an applicati...

CVE-2026-91794: Out-of-bounds Write

An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution...

CVE-2026-91805: Use After Free

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash...

PT-2026-97230

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A heap-based out-of-bounds write occurs in the PRC parser due to insufficient validation of vertex indices within triangular fan texture meshes. This flaw can lead to memory...

CVE-2026-91818: Use After Free

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash...

CVE-2026-91806: Use After Free

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to the custom attributes YAML editor. Users with permission to create or edit webforms but without permission to edit...

CVE-2026-91790: Use After Free

When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed. As a result, the program may access an already-freed internal data structure, triggering a crash due to UAF...

Foxit PDF Editor for Mac < 13.2.7 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor for Mac application previously named Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 13.2.7. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on...

PT-2026-97222

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A local privilege escalation issue exists in the updater of Foxit PDF Editor/Reader. The problem occurs because the updater unsafely loads dynamic-link libraries DLLs—which ar...

PT-2026-97237

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A use-after-free issue exists in the JavaScript handling of PDF annotations. This occurs when reentrant page-event processing during annotation enumeration releases the...

PT-2026-97235

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A use-after-free condition occurs during the handling of PDF annotations. This issue is triggered by reentrant annotation deletion via embedded JavaScript, which causes the...

PT-2026-97215

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description The interface lacks permission verification for secure reading mode. This allows a specially crafted PDF to trigger external SMB Server Message Block authentication without...

PT-2026-97224

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An issue exists in the PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, which causes the application to access released pag...

CVE-2026-91798: Incorrect Permission Assignment for Critical Resource

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges...

PT-2026-97207

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An information disclosure issue exists in the JavaScript interface implementation where attribute authorization checks required by the specification are not performed. This...

CVE-2026-91816: Use After Free

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and applicati...

PT-2026-97217

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A local privilege escalation issue exists in the update daemon of Foxit PDF Editor/Reader. This is caused by an insecure permission configuration that allows regular users to...

PT-2026-97209

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A Use-After-Free UAF issue occurs when the software renders a page image. The program fails to validate image objects with malformed optional content attributes, leading to th...