CVE-2026-119433

Server-Side Request Forgery in Foxit Workspace PDF Export

A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this issue to induce the server to send requests to arbitrary internal or external resources, potentially enabling unauthorized access to internal services, network reconnaissance, and sensitive information disclosure.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Foxitsoftware

Products

Foxit Workspace

CVE-2026-119432

Foxit Workspace Stored XSS in shared artifacts

A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially accessing locally stored credentials and enabling credential theft.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Foxitsoftware

Products

Foxit Workspace

CVE-2026-119431

Server-Side Request Forgery in Foxit Workspace File Upload

A server-side request forgery (SSRF) vulnerability exists in Foxit Workspace's file-upload functionality. Insufficient validation of user-supplied links may allow a remote attacker to induce the server to access internal resources and return their contents, potentially resulting in sensitive information disclosure and unauthorized access to internal services.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Foxitsoftware

Products

Foxit Workspace

CVE-2026-111419

Hardcoded API Token in Foxit Official Website

A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Foxitsoftware

Products

Foxit.com

CVE-2026-111418

SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service

A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Foxitsoftware

Products

Foxit.com

CVE-2026-111417

Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Foxitsoftware

Products

Foxit.com

CVE-2026-91814

Security vulnerability: Foxit PDF Editor/Reader Fails to Detect Modifications to Signed Documents Displaying Newly Added Content

A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxitsoftware and 1 more

Products

Macos Pdf Editor Pdf Reader and 3 more

CVE-2026-91794

Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulnerability

An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxitsoftware and 1 more

Products

Macos Pdf Editor Pdf Reader and 3 more

CVE-2026-91788

Foxit PDF Editor/Reader Missing Authorization Information Disclosure Vulnerability

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxitsoftware and 1 more

Products

Macos Pdf Editor Pdf Reader and 3 more

CVE-2026-91800

Foxit PDF Editor installer local privilege escalation

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxitsoftware

Products

Macos Pdf Editor Pdf Reader and 1 more

CVE-2026-91807

Foxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxitsoftware and 1 more

Products

Macos Pdf Editor Pdf Reader and 3 more

CVE-2026-91811

Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Foxit Foxitsoftware and 1 more

Products

Macos Pdf Editor Pdf Reader and 3 more

CVE-2026-91803

Security Vulnerability Report – Foxit PDF Editor/Reader Updater DLL Search Path Hijacking

A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-91809

Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-91810

Foxit PDF Editor/Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Pdf Editor and 2 more

CVE-2026-91812

Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-91813

Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-91815

Foxit PDF Editor/Reader JPEG2000 Parsing Memory Corruption Remote Code Execution Vulnerability

Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-91816

Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2026-91818

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more