Foxit PDF Reader and Editor Updates Address 31 Vulnerabilities
Tech GuruQuick Answer
Foxit's September 23 update covers 31 CVEs across PDF Reader and Editor release streams. Besides malicious-document memory errors, it includes updater privilege escalation, credential-hash exposure, file-path traversal and misleading signature validation. Match Reader versus Editor, Windows versus macOS and the installed release branch before choosing the corresponding fixed version below. Do not assume all 31 CVEs affect every listed product.
Confirm Scope And Apply The Supported Fix
What to do now: inventory product, operating system and full build number across managed and standalone installations. Arrange the matching vendor-supported update, close the application as required by its installer, and limit untrusted PDFs during the change. Keep installer provenance and deployment results with the asset record.
Source recheck: October 2, 2026 UTC, against Foxit's September 23 platform-specific bulletin sections. This review checked source text and version mappings, not application behavior or installer authenticity on your endpoints.
Scope And Authority
| Product scope | Foxit PDF Reader and PDF Editor on the Windows/macOS branches listed in the September 23 bulletin; applicability varies by CVE, platform and release stream. |
|---|---|
| Advisory | Foxit September 23, 2026 Security Updates |
| CVEs | CVE-2026-91788, CVE-2026-91789, CVE-2026-91790, CVE-2026-91791, CVE-2026-91792, CVE-2026-91793, CVE-2026-91794, CVE-2026-91795, CVE-2026-91796, CVE-2026-91797, CVE-2026-91798, CVE-2026-91799, CVE-2026-91800, CVE-2026-91801, CVE-2026-91802, CVE-2026-91803, CVE-2026-91804, CVE-2026-91805, CVE-2026-91806, CVE-2026-91807, CVE-2026-91808, CVE-2026-91809, CVE-2026-91810, CVE-2026-91811, CVE-2026-91812, CVE-2026-91813, CVE-2026-91814, CVE-2026-91815, CVE-2026-91816, CVE-2026-91817, CVE-2026-91818 |
| Authoritative release date | 2026-09-23 07:49:06.201 UTC |
| Authority revision date | 2026-09-23 15:26:33.453 UTC |
| Affected versions | Windows: Reader 2026.2.0.39747 and earlier; Editor 2026.2.0.39747, 14.0.7.33751, 13.2.6.24111 and the older annual branches listed by Foxit. macOS: Reader 2026.2.0.72029 and earlier; Editor 2026.2.0.72029, 14.0.7.69441, 13.2.6.63484 and the older annual branches listed by Foxit. Use the platform-specific bulletin, not a Windows build suffix applied to a Mac. |
| Fixed version | Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1, 14.0.8, or 13.2.7 as appropriate |
| CVSS base score | 4.7 / 5.3 / 6.1 / 7.8 / 7.9 / 8.8 (CVSS v3 as published by Foxit) |
| CVSS severity | Moderate to Important |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Document handling: the memory-safety fixes cover U3D/GIF, WebP, JPEG2000, PRC meshes, malformed colors and image masks, FileOpen encryption metadata, page trees, forms, annotations and embedded JavaScript. Some reports describe crashes; others identify possible code execution or disclosure, so neither outcome should be generalized to every CVE.
Trust boundaries: CVE-2026-91788 concerns cross-document JavaScript access; 91796 concerns external SMB authentication and credential-hash exposure; 91797 and 91801 concern writes outside intended paths; 91814 concerns altered content appearing validly signed.
Privileged maintenance: 91798, 91800, 91803, 91812 and 91813 concern installer/updater permissions, library loading, certificate checks or replacement of an update between download and extraction. Those issues require a trusted update process as well as careful document handling. The complete CVE identifiers remain in the table above.
What To Validate Now
- Inventory. Record Reader/Editor, OS, full build, update mechanism, deployment owner and any separate legacy or virtual-desktop installations. Match each item to its own vendor bulletin section.
- Establish applicability. Use the platform-specific affected builds above and Foxit's individual CVE rows. For example, the Mac installer issue does not establish an identical Windows installer defect, and the 13.x matrix differs from the newer branches.
- Remediate. Apply Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1, 14.0.8, or 13.2.7 as appropriate through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the launched application build after deployment, then test representative forms, annotations, printing and signed-document workflows with approved synthetic files. Do not open exploit PDFs, trigger external credential authentication or exercise updater races on production endpoints.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
