Foxit PDF Reader: RCE via Malicious PDF, 68 Days to Patch

On September 23, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-734 detailing a directory traversal vulnerability in Foxit PDF Reader that allows remote execution of arbitrary code. The flaw, tracked as CVE-2026-91801 with a CVSS 7.8 HIGH rating, was reported to the vendor on July 17: 68 days of coordinated disclosure that expose a recurring security pattern in alternative PDF readers, which often receive less scrutiny than mainstream products.

The Mechanism: How a RichMedia Annotation Becomes a Weapon

The flaw resides in the handling of RichMedia annotations, the feature that allows embedding interactive multimedia content in PDF documents. As the ZDI advisory documents, "the specific flaw exists within the handling of RichMedia annotations." The problem stems from a "lack of proper validation of a user-supplied path prior to using it in file operations": the software accepts paths supplied by the document without verifying their legitimacy.

The CVE-2026-91801 record adds a significant technical detail: "Insufficient validation of resource file paths may allow files to be written outside their intended locations." This arbitrary file write is the springboard for code execution, likely through overwriting system executables or libraries. The ZDI advisory confirms the consequence: "An attacker can leverage this vulnerability to execute code in the context of the current user."

The full CVSS vector string — AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — paints a precise threat profile: local attack requiring user interaction, zero prior privileges, total impact on confidentiality, integrity, and availability. The "L" in Attack Vector does not mean physical access to the machine, but that the entry vector is a local file or web page the user must open.

The 68-Day Timeline and Foxit Context

"User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file." — Advisory ZDI-26-734

Coordinated disclosure is a standard ZDI process, but the numbers tell a specific story. On July 17, 2026, researcher Liang Zhu submitted the report. On September 23, 2026, after 68 days, the advisory went public. During this window Foxit released a corrective update: "Foxit has issued an update to correct this vulnerability," notes the advisory, though neither ZDI nor the CVE record specify the patched version or exact vulnerable versions.

This interval falls within the typical responsible disclosure window, but it raises an operational question for enterprises. Foxit PDF Reader is deployed in many organizations as a lightweight alternative to Adobe Acrobat, often outside centralized patching radars. The ease of exploitation — simple user interaction, no privileges required, full impact — makes this 68-day window a concrete exposure period for unpatched environments.

A contextual element emerges from the list of published ZDI advisories: Foxit appears with above-average frequency compared to other productivity software vendors. This pattern, highlighted in the ZDI advisory collection, suggests a larger attack surface or less robust input sanitization in Foxit's PDF parser compared to competitors.

What to Do Now

Operational actions derive directly from the facts documented in the sources:

• Verify the presence of Foxit PDF Reader and Foxit PDF Editor in the corporate installed base, since the CVE-2026-91801 record mentions both products while advisory ZDI-26-734 is specific to the Reader
• Apply the update released by Foxit, indicated in the ZDI advisory as available, though the patched version is not specified in available sources
• Track Foxit with the same priority as Adobe Acrobat in patch management workflows, given the vulnerability's severity and the recurring pattern of flaws in the product
• Strengthen inbound PDF filtering in email, since the sole prerequisite for exploitation is opening a malicious file

The Blind Spot of Alternative PDF Readers

Liang Zhu's discovery highlights a dissonance in enterprise defensive posture. Adobe Acrobat undergoes constant scrutiny: EDR vendors, threat intelligence platforms, and security teams monitor every advisory with surgical attention. Foxit, Nitro, Sumatra, and other alternative readers often occupy peripheral positions in the software supply chain, installed by individual departments or users without centralized tracking.

The result is a hidden but technically equivalent attack surface. A malicious PDF file does not ask the recipient which reader they use: if Foxit is installed, CVE-2026-91801 is exploitable with the same phishing vectors criminals already employ. The difference lies only in defensive awareness, which is systematically lower for these products.

The sources do not document in-the-wild exploits or active attack campaigns. However, the low attack complexity (AC:L) and absence of privilege prerequisites make the vulnerability technically exploitable without significant barriers. The hypothesis that threat actors are already testing the vector is reasonable but unverified in available sources.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-734/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.cve.org/CVERecord?id=CVE-2026-91801
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html

Information verified against cited sources and current as of publication.

Sources