CVE-2026-91814 PUBLISHED

Security vulnerability: Foxit PDF Editor/Reader Fails to Detect Modifications to Signed Documents Displaying Newly Added Content

Assigner: Foxit
Reserved: 15.09.2026 Published: 23.09.2026 Updated: 23.09.2026

A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Foxit Software Inc.
Product	Foxit PDF Editor
Versions	Default: unaffected Version Versions 2026.2 and earlier is affected Version Versions 14.0.7 and earlier is affected Version Versions 13.2.6 and earlier is affected

Vendor	Foxit Software Inc.
Product	Foxit PDF Reader
Versions	Default: unaffected Version Versions 2026.2 and earlier is affected

Credits

Jan Slabon (Setasign GmbH & Co. KG), Germany finder

References

https://www.foxit.com/support/security-bulletins.html

Problem Types

CWE-347 Improper Verification of Cryptographic Signature CWE

Impacts

Content Spoofing