Protection mechanism failure in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2026-91796
Published: September 23, 2026
Vulnerability identifier: #VU151829
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-91796
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose information.
The vulnerability exists due to protection mechanism failure in the JavaScript API when opening PDFs containing certain JavaScript code. A remote attacker can trick the victim into opening a crafted PDF to disclose information.
A crafted PDF can trigger external SMB authentication without security prompts.
Affected software
Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Windows
How to mitigate CVE-2026-91796
Install security update from vendor's website.
Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 13.2.7.24160, 14.0.8.33807, 2026.2.1.39815
Foxit PDF Reader for Windows - update to 2026.2.1.39815
Foxit PDF Reader for Windows - update to 2026.2.1.39815