CVE-2026-91814
Full vulnerability record from the local CVENow database.
Description
A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
14984358-7092-470d-8f34-ade47a7658a2
Published
2026-09-23 08:17:13.673000
Last modified
2026-10-29 17:15:42.253000
View original CVE JSON
{
"id": "CVE-2026-91814",
"sourceIdentifier": "14984358-7092-470d-8f34-ade47a7658a2",
"published": "2026-09-23T08:17:13.673",
"lastModified": "2026-10-29T17:15:42.253",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed."
}
],
"affected": [
{
"source": "14984358-7092-470d-8f34-ade47a7658a2",
"affectedData": [
{
"vendor": "Foxit Software Inc.",
"product": "Foxit PDF Editor",
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"MacOS"
],
"versions": [
{
"version": "Versions 2026.2 and earlier",
"status": "affected"
},
{
"version": "Versions 14.0.7 and earlier",
"status": "affected"
},
{
"version": "Versions 13.2.6 and earlier",
"status": "affected"
}
]
},
{
"vendor": "Foxit Software Inc.",
"product": "Foxit PDF Reader",
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"MacOS"
],
"versions": [
{
"version": "Versions 2026.2 and earlier",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "14984358-7092-470d-8f34-ade47a7658a2",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-09-23T14:24:09.232400Z",
"id": "CVE-2026-91814",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "14984358-7092-470d-8f34-ade47a7658a2",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-347"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionEndIncluding": "13.2.5.63482",
"matchCriteriaId": "F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "14.0.0.33046",
"versionEndIncluding": "14.0.7.33751",
"matchCriteriaId": "ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2023.1.0.15510",
"versionEndIncluding": "2023.3.0.23028",
"matchCriteriaId": "0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2024.1.0.23997",
"versionEndIncluding": "2024.4.1.27687",
"matchCriteriaId": "2C06BC41-9831-4AE3-B10B-3FC313D01580"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2025.1.0.27937",
"versionEndIncluding": "2025.3.0.35737",
"matchCriteriaId": "AD0AAFC0-5B9B-4A11-8967-4699792850F1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2026.1.0.36452",
"versionEndIncluding": "2026.2.0.39747",
"matchCriteriaId": "757FC908-7C20-4D94-B5E4-83590D451EA1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2026.2.0.39747",
"matchCriteriaId": "379C8399-B43C-47AE-BA7B-0FAC7682BF7B"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionEndIncluding": "13.2.2.63349",
"matchCriteriaId": "2C7DEE55-1FE3-4B41-975D-BB926E9E69D4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "14.0.0.68868",
"versionEndIncluding": "14.0.7.69441",
"matchCriteriaId": "C887A2B3-8FF9-4F97-9580-D085BEDE7201"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2023.1.0.55583",
"versionEndIncluding": "2023.3.0.63083",
"matchCriteriaId": "D8785CCE-C44C-4908-9133-13A580D5BECB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2024.1.0.63682",
"versionEndIncluding": "2024.4.1.66479",
"matchCriteriaId": "CF043D20-0E28-481C-8756-D1301FAE67D2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2025.1.0.66692",
"versionEndIncluding": "2025.3.0.69570",
"matchCriteriaId": "20698FD4-5E28-4206-ACEA-4FCD24AD23BE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2026.1.0.70169",
"versionEndIncluding": "2026.2.0.72029",
"matchCriteriaId": "72510597-6566-4748-8F69-099EBF8B5D21"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2026.2.1.39815",
"matchCriteriaId": "A6C4B75F-C060-4B92-9646-0E621DB9BF63"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
}
]
}
]
}
],
"references": [
{
"url": "https://www.foxit.com/support/security-bulletins.html",
"source": "14984358-7092-470d-8f34-ade47a7658a2",
"tags": [
"Vendor Advisory"
]
}
]
}