CVE-2026-91814
Last modified
CVE-2026-91814 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Foxit | Pdf Editor | <= 13.2.5.63482 |
| Foxit | Pdf Editor | >= 14.0.0.33046, <= 14.0.7.33751 |
| Foxit | Pdf Editor | >= 2023.1.0.15510, <= 2023.3.0.23028 |
| Foxit | Pdf Editor | >= 2024.1.0.23997, <= 2024.4.1.27687 |
| Foxit | Pdf Editor | >= 2025.1.0.27937, <= 2025.3.0.35737 |
| Foxit | Pdf Editor | >= 2026.1.0.36452, <= 2026.2.0.39747 |
| Foxit | Pdf Reader | <= 2026.2.0.39747 |
| Foxit | Pdf Editor | <= 13.2.2.63349 |
| Foxit | Pdf Editor | >= 14.0.0.68868, <= 14.0.7.69441 |
| Foxit | Pdf Editor | >= 2023.1.0.55583, <= 2023.3.0.63083 |
| Foxit | Pdf Editor | >= 2024.1.0.63682, <= 2024.4.1.66479 |
| Foxit | Pdf Editor | >= 2025.1.0.66692, <= 2025.3.0.69570 |
| Foxit | Pdf Editor | >= 2026.1.0.70169, <= 2026.2.0.72029 |
| Foxit | Pdf Reader | <= 2026.2.1.39815 |
References
- https://www.foxit.com/support/security-bulletins.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-91814?
How severe is CVE-2026-91814?
How do I fix CVE-2026-91814?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-91809A use-after-free vulnerability exists in Foxit PDF Editor/Re…7.8
- CVE-2026-9181Esri ArcGIS Server contains a directory traversal vulnerabil…7.5
- CVE-2026-91810A heap-based out-of-bounds read vulnerability exists in Foxi…6.1
- CVE-2026-91811A heap-based out-of-bounds write vulnerability exists in Fox…7.8
- CVE-2026-91812A vulnerability in Foxit PDF Editor/Reader’s update mechanis…8.1
- CVE-2026-91813A vulnerability in Foxit PDF Editor/Reader’s update mechanis…7.8
- CVE-2026-91815Foxit PDF Editor/Reader does not perform sufficient verifica…7.8
- CVE-2026-91816A use-after-free vulnerability exists in Foxit PDF Editor/Re…7.8
- CVE-2026-91817A heap-based out-of-bounds read vulnerability exists in Foxi…6.1
- CVE-2026-91818A use-after-free vulnerability exists in Foxit PDF Editor/Re…5.5
- CVE-2026-91819Affected versions of MISP rely on CakePHP request-method ove…6.9
- CVE-2026-9182Esri ArcGIS Server contains an unrestricted file upload vuln…9.8
Are you affected by CVE-2026-91814?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST