Foxit vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-111419 A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information.High 8.6 · Oct 29, 2026
• CVE-2026-111418 A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service.High 7.5 · Oct 29, 2026
• CVE-2026-111417 A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conveHigh 7.5 · Oct 29, 2026
• CVE-2026-91818 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations.High 7.8 · Sep 23, 2026
• CVE-2026-91816 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations.High 7.8 · Sep 23, 2026
• CVE-2026-91815 Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap High 7.8 · Sep 23, 2026
• CVE-2026-91813 A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insuHigh 8.8 · Sep 23, 2026
• CVE-2026-91812 A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, High 7.9 · Sep 23, 2026
• CVE-2026-91811 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fanHigh 7.8 · Sep 23, 2026
• CVE-2026-91809 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields.High 7.8 · Sep 23, 2026
• CVE-2026-91806 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields.High 7.8 · Sep 23, 2026
• CVE-2026-91805 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling.High 7.8 · Sep 23, 2026
• CVE-2026-91804 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in sHigh 7.8 · Sep 23, 2026
• CVE-2026-91803 A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writableHigh 8.8 · Sep 23, 2026
• CVE-2026-91802 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffHigh 7.8 · Sep 23, 2026
• CVE-2026-91801 A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources.High 7.8 · Sep 23, 2026
• CVE-2026-91800 A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuratiHigh 8.8 · Sep 23, 2026
• CVE-2026-91799 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects.High 7.8 · Sep 23, 2026
• CVE-2026-91798 A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the coHigh 8.8 · Sep 23, 2026
• CVE-2026-91797 Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be writtenHigh 7.8 · Sep 23, 2026
• CVE-2026-91795 Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files.High 7.8 · Sep 23, 2026
• CVE-2026-91794 An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation whenHigh 7.8 · Sep 23, 2026
• CVE-2026-91793 When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data.High 7.8 · Sep 23, 2026
• CVE-2026-91792 When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScripHigh 7.8 · Sep 23, 2026
• CVE-2026-91791 When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibHigh 7.8 · Sep 23, 2026