{"api_version":"1","generated_at":"2026-10-02T18:55:58+00:00","cve":"CVE-2026-91795","urls":{"html":"https://cve.report/CVE-2026-91795","api":"https://cve.report/api/cve/CVE-2026-91795.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-91795","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-91795"},"summary":{"title":"Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerability","description":"Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution.","state":"PUBLISHED","assigner":"Foxit","published_at":"2026-09-23 08:17:11","updated_at":"2026-09-23 17:58:26"},"problem_types":["CWE-822","CWE-822 CWE-822 Untrusted pointer dereference"],"metrics":[{"version":"3.1","source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","name":"https://www.foxit.com/support/security-bulletins.html","refsource":"14984358-7092-470d-8f34-ade47a7658a2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91795","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91795","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","version":"affected Versions 2026.2 and earlier","platforms":["Windows"]},{"source":"CNA","vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","version":"affected Versions 14.0.7 and earlier","platforms":["Windows"]},{"source":"CNA","vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","version":"affected Versions 13.2.6 and earlier","platforms":["Windows"]},{"source":"CNA","vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","version":"affected Versions 2026.2 and earlier","platforms":["Windows"]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Pwn2Sleep working with TrendAI Zero Day Initiative","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"91795","cve":"CVE-2026-91795","epss":"0.001200000","percentile":"0.020550000","score_date":"2026-09-23","updated_at":"2026-09-24 00:07:15"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-91795","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-23T14:46:41.289496Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-23T14:46:49.126Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Foxit PDF Editor","vendor":"Foxit Software Inc.","versions":[{"status":"affected","version":"Versions 2026.2 and earlier"},{"status":"affected","version":"Versions 14.0.7 and earlier"},{"status":"affected","version":"Versions 13.2.6 and earlier"}]},{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Foxit PDF Reader","vendor":"Foxit Software Inc.","versions":[{"status":"affected","version":"Versions 2026.2 and earlier"}]}],"credits":[{"lang":"en","type":"finder","value":"Pwn2Sleep working with TrendAI Zero Day Initiative"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution."}],"value":"Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution."}],"impacts":[{"descriptions":[{"lang":"en","value":"Potential arbitrary code execution"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-822","description":"CWE-822 Untrusted pointer dereference","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-23T07:51:06.870Z","orgId":"14984358-7092-470d-8f34-ade47a7658a2","shortName":"Foxit"},"references":[{"url":"https://www.foxit.com/support/security-bulletins.html"}],"title":"Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerability","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"14984358-7092-470d-8f34-ade47a7658a2","assignerShortName":"Foxit","cveId":"CVE-2026-91795","datePublished":"2026-09-23T07:51:06.870Z","dateReserved":"2026-09-15T07:34:40.287Z","dateUpdated":"2026-09-23T14:46:49.126Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-23 08:17:11","lastModifiedDate":"2026-09-23 17:58:26","problem_types":["CWE-822","CWE-822 CWE-822 Untrusted pointer dereference"],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:46:41.289496Z","id":"CVE-2026-91795","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"91795","Ordinal":"1","Title":"Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote C","CVE":"CVE-2026-91795","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"91795","Ordinal":"1","NoteData":"Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution.","Type":"Description","Title":"Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote C"}]}}}