CVE-2026-91788: Foxit PDF Editor/Reader Missing Authorization Information Disclosure Vulnerability

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-23 · updated 2026-10-29
Weakness: CWE-668

Description

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.

Affected products

Foxit PDF Reader: through 13.2.6.24111; from 14.0.0.33046 through 14.0.7.33751; from 2023.1.0.15510 through 2023.3.0.23028; from 2024.1.0.23997 through 2024.4.1.27687; from 2025.1.0.27937 through 2025.3.0.35737; from 2026.1.0.36452 through 2026.2.0.39747
Foxit Pdf Reader: through 2026.2.0.39747; through 2026.2.0.72029
Foxit Software Inc. Foxit PDF Editor: through Versions 2026.2; through Versions 14.0.7; through Versions 13.2.6
Foxit Software Inc. Foxit PDF Reader: through Versions 2026.2

References

https://www.foxit.com/support/security-bulletins.html

Get alerted when CVE-2026-91788 or the next vulnerability affects your stack