A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://www.foxit.com/support/security-bulletins.html Vendor Advisory
Vendor advisories in the News 1
- ZDI-26-739: Foxit PDF Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability Zero Day Initiative: published advisories · 2026-09-23
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.1 · foxitNVD modified 2026-10-08 14:04
Affected (CPE criteria) 2
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*
References 1
- https://www.foxit.com/support/security-bulletins.html Vendor Advisory