CVE-2026-91788 PUBLISHED

Foxit PDF Editor/Reader Missing Authorization Information Disclosure Vulnerability

Assigner: Foxit
Reserved: 15.09.2026 Published: 23.09.2026 Updated: 23.09.2026

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS Score: 4.7

Product Status

Vendor Foxit Software Inc.
Product Foxit PDF Editor
Versions Default: unaffected
  • Version Versions 2026.2 and earlier is affected
  • Version Versions 14.0.7 and earlier is affected
  • Version Versions 13.2.6 and earlier is affected
Vendor Foxit Software Inc.
Product Foxit PDF Reader
Versions Default: unaffected
  • Version Versions 2026.2 and earlier is affected

Credits

  • kai63001 working with TrendAI Zero Day Initiative finder

References

Problem Types

  • CWE-668 Exposure of Resource to Wrong Sphere CWE

Impacts

  • Information Disclosure