CVE-2026-91788
Full vulnerability record from the local CVENow database.
Description
When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
14984358-7092-470d-8f34-ade47a7658a2
Published
2026-09-23 08:17:10.623000
Last modified
2026-10-29 17:11:18.827000
View original CVE JSON
{
"id": "CVE-2026-91788",
"sourceIdentifier": "14984358-7092-470d-8f34-ade47a7658a2",
"published": "2026-09-23T08:17:10.623",
"lastModified": "2026-10-29T17:11:18.827",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally."
}
],
"affected": [
{
"source": "14984358-7092-470d-8f34-ade47a7658a2",
"affectedData": [
{
"vendor": "Foxit Software Inc.",
"product": "Foxit PDF Editor",
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"MacOS"
],
"versions": [
{
"version": "Versions 2026.2 and earlier",
"status": "affected"
},
{
"version": "Versions 14.0.7 and earlier",
"status": "affected"
},
{
"version": "Versions 13.2.6 and earlier",
"status": "affected"
}
]
},
{
"vendor": "Foxit Software Inc.",
"product": "Foxit PDF Reader",
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"MacOS"
],
"versions": [
{
"version": "Versions 2026.2 and earlier",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "14984358-7092-470d-8f34-ade47a7658a2",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.0,
"impactScore": 3.6
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-09-23T14:11:39.537445Z",
"id": "CVE-2026-91788",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "14984358-7092-470d-8f34-ade47a7658a2",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-668"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionEndIncluding": "13.2.6.24111",
"matchCriteriaId": "CD5CCA3D-98C4-42A5-9DA4-001AD60FD2DC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "14.0.0.33046",
"versionEndIncluding": "14.0.7.33751",
"matchCriteriaId": "ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2023.1.0.15510",
"versionEndIncluding": "2023.3.0.23028",
"matchCriteriaId": "0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2024.1.0.23997",
"versionEndIncluding": "2024.4.1.27687",
"matchCriteriaId": "2C06BC41-9831-4AE3-B10B-3FC313D01580"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2025.1.0.27937",
"versionEndIncluding": "2025.3.0.35737",
"matchCriteriaId": "AD0AAFC0-5B9B-4A11-8967-4699792850F1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2026.1.0.36452",
"versionEndIncluding": "2026.2.0.39747",
"matchCriteriaId": "757FC908-7C20-4D94-B5E4-83590D451EA1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2026.2.0.39747",
"matchCriteriaId": "379C8399-B43C-47AE-BA7B-0FAC7682BF7B"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionEndIncluding": "13.2.6.63484",
"matchCriteriaId": "92336E4D-D9B0-4629-97D6-028308036214"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "14.0.0.68868",
"versionEndIncluding": "14.0.7.69441",
"matchCriteriaId": "C887A2B3-8FF9-4F97-9580-D085BEDE7201"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2023.1.0.55583",
"versionEndIncluding": "2023.3.0.63083",
"matchCriteriaId": "D8785CCE-C44C-4908-9133-13A580D5BECB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2024.1.0.63682",
"versionEndIncluding": "2024.4.1.66479",
"matchCriteriaId": "CF043D20-0E28-481C-8756-D1301FAE67D2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2025.1.0.66692",
"versionEndIncluding": "2025.3.0.69570",
"matchCriteriaId": "20698FD4-5E28-4206-ACEA-4FCD24AD23BE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2026.1.0.70169",
"versionEndIncluding": "2026.2.0.72029",
"matchCriteriaId": "72510597-6566-4748-8F69-099EBF8B5D21"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2026.2.0.72029",
"matchCriteriaId": "3EAB06EC-F222-463E-9441-0A6A2FC06288"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
}
]
}
]
}
],
"references": [
{
"url": "https://www.foxit.com/support/security-bulletins.html",
"source": "14984358-7092-470d-8f34-ade47a7658a2",
"tags": [
"Vendor Advisory"
]
}
]
}