Foxit PDF form flaws expose Reader users to code execution

A PDF form can be enough to reach code execution in Foxit PDF Reader or Editor. In its October 7 vulnerability roundup, Cisco Talos describes two separate flaws involving malformed PDF content and JavaScript. People opening documents in Foxit are the exposed group; a user has to open the crafted file for the PDF processing path to run. Talos says Foxit has patched the flaws.

Foxit’s record for CVE-2026-91799 lists Windows Reader through 2026.2 as affected, while its record for CVE-2026-57256 includes Windows and macOS Reader through 2026.1.1. A Windows Reader fleet that moved to 2026.2 remains in the affected range for CVE-2026-91799. The two records also cover Editor, with different branches and platforms.

Two PDF processing failures

For CVE-2026-57256, Talos identifies JavaScript checkbox CBF_Widget handling in Foxit Reader 2026.1.1.36485 and says a malformed file can lead to remote code execution. Foxit’s own CVE description names list-box form handling instead: it describes repeated operations after a form reset, invalid form-object or dictionary pointers, an illegal pointer read, and a crash. The form-control descriptions conflict. Treat the CVE as the common tracking identifier and use Foxit’s affected-product list to scope updates; avoid assuming that a crash in either control is a reliable exploitation indicator.

The other flaw, CVE-2026-91799, is a use-after-free in PDF JavaScript array processing. Foxit says, “A specially crafted PDF may cause the application to access a released object during array processing,” with a crash or arbitrary code execution as possible outcomes. Talos likewise describes a malicious PDF carrying JavaScript that causes memory corruption. The application reaches that path when it processes the crafted document, so external PDF intake is the workflow to protect.

PDF opens and crash signals

Both Foxit CVE records rate the issues 7.8 under CVSS v3.1 and specify user interaction. Opening a crafted PDF triggers processing; investigate suspicious PDF opens with the document and process history. The Foxit records credit KPC of Cisco Talos as the finder of both flaws. Neither the Talos roundup nor the Foxit records describes exploitation in the wild.

Check platforms before updating

Foxit lists Windows and macOS Reader 2026.1.1 and earlier for CVE-2026-57256. Editor coverage extends to Windows 2026.1.1, 14.0.4 and 13.2.4 and earlier in those respective branches, plus macOS 2026.1.1 and 14.0.3 and earlier. These are affected-range endpoints in Foxit’s record, not versions to install.

For CVE-2026-91799, Foxit lists Windows Reader 2026.2 and earlier; Windows Editor 2026.2, 14.0.7 and 13.2.6 and earlier in their branches. That record identifies Windows products; use the first CVE’s macOS ranges when checking Macs. The older 2026.1.1 Reader line appears in both affected ranges on Windows.

Installed versions and platforms determine update choices. Foxit links its security bulletins from both CVE records, and Talos says the listed issues have been patched. For each installed branch, obtain the applicable fixed release from Foxit, deploy it, and check the installed build on the endpoints afterward.

Keep untrusted PDFs off affected builds

Inventory Foxit PDF Reader and Editor installations by operating system, product, branch and installed build. Prioritize teams opening external PDF forms. Until the vendor-fixed release is installed and verified on those machines, route untrusted PDFs away from affected Foxit applications. This removes the described processing path from that workflow while deployment is in progress.

If endpoint telemetry shows Foxit crashing after a PDF was opened, retain the document and the application’s process history for investigation; a crash alone cannot distinguish this flaw from an ordinary application failure. Check for unexpected child processes or subsequent activity in the same session, without treating the absence of those events as a clean bill of health. A version inventory and post-update installed-build check give you a concrete way to track remediation across this fleet.

After deployment, compare each endpoint’s installed Foxit build with the fixed release for its own product and branch in Foxit’s bulletin. An endpoint still running an affected build remains on the update list, even if its update policy says automatic updates are enabled. The expected result is an installed vendor-fixed build for the right product and branch on every endpoint that opens external PDFs.