4.7Mittel
CVE-2026-91788Foxit PDF Editor/Reader Missing Authorization Information Disclosure Vulnerability
Beschreibung
When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.
Schwachstellentyp (CWE):
CWE-668
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Foxit Software Inc. | Foxit PDF Editor | Versions 2026.2 and earlier, Versions 14.0.7 and earlier, Versions 13.2.6 and earlier | |
| Foxit Software Inc. | Foxit PDF Reader | Versions 2026.2 and earlier | |
| foxit | pdf editor | ≤ 13.2.6.24111 | |
| foxit | pdf reader | ≤ 2026.2.0.39747 |
Referenzen und Patches
- https://www.foxit.com/support/security-bulletins.html Vendor Advisory
CPE-Treffer (NVD) (14)
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≤ 13.2.6.24111cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 14.0.0.33046 ≤ 14.0.7.33751cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2023.1.0.15510 ≤ 2023.3.0.23028cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2024.1.0.23997 ≤ 2024.4.1.27687cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2025.1.0.27937 ≤ 2025.3.0.35737cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2026.1.0.36452 ≤ 2026.2.0.39747cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*≤ 2026.2.0.39747cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≤ 13.2.6.63484cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 14.0.0.68868 ≤ 14.0.7.69441cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2023.1.0.55583 ≤ 2023.3.0.63083cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2024.1.0.63682 ≤ 2024.4.1.66479cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2025.1.0.66692 ≤ 2025.3.0.69570cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2026.1.0.70169 ≤ 2026.2.0.72029cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*≤ 2026.2.0.72029