CVE-2026-91818: Foxit PDF Reader Annotation Use-After-Free — Detection and Remediation Guide for SOC Teams

The Zero Day Initiative has published ZDI-26-746, disclosing a use-after-free (UAF) vulnerability in Foxit PDF Reader tracked as CVE-2026-91818 with a CVSS score of 7.8 (High). The flaw lives in the application's annotation handling logic and allows a remote attacker to execute arbitrary code in the context of the current user when that user opens a crafted PDF file or visits a malicious page that delivers one.

This is the exact class of vulnerability that fuels initial access in enterprise intrusions. PDF readers remain one of the most abused client-side attack surfaces because they sit at the intersection of phishing delivery and document-driven social engineering. A 7.8-rated code execution bug in a widely deployed PDF reader — one commonly used as a lighter alternative to Adobe Acrobat in corporate environments — is a priority patching item for every organization that allows Foxit in its software inventory. If your endpoint protection and email filtering stack is tuned around Acrobat exploit detections only, you have a blind spot.

Technical Analysis

What the vulnerability is

Per the ZDI advisory, the flaw is a use-after-free condition within the parsing of annotation objects in PDF documents. Annotations (comments, markup, embedded interactive elements) are one of the most structurally complex parts of the PDF specification, and annotation parsing has historically been a fertile source of memory corruption bugs across all major PDF readers.

The mechanics, from a defender's perspective:

1. The vulnerable code path operates on annotation objects during document parsing/rendering.
2. The affected object handling fails to validate the existence of an object prior to performing operations on it — a classic missing lifetime check.
3. An attacker can craft a PDF that frees a heap object and subsequently triggers reuse of the freed memory region, corrupting program state and redirecting execution flow.
4. Successful exploitation yields code execution in the context of the logged-on user — meaning the payload inherits whatever privileges that user has, including access to their credentials, mapped shares, email, and any tokens in memory.

Exploitation requirements

• User interaction is required. The target must open a malicious PDF or visit a malicious page that loads the document through the reader (including browser plugin/embedded scenarios).
• No authentication is required on the attacker's side — this is a pure delivery problem. Phishing email attachments, malicious links, watering-hole downloads, and cloud-shared documents are all viable delivery vectors.

Affected products and severity

Confirm the exact affected version ranges against the Foxit security bulletin referenced from the ZDI advisory page — do not assume your installed version is safe simply because it auto-updates; many enterprises pin or disable Foxit updaters for change-control reasons, leaving endpoints stranded on vulnerable builds.

Exploitation status

As of this writing, the advisory is a coordinated ZDI disclosure. There is no confirmed inclusion in the CISA Known Exploited Vulnerabilities catalog and no public PoC at the time of publication. That is a window, not a reprieve — ZDI publication typically accelerates reverse engineering of the patch, and UAF bugs in document parsers are routinely weaponized within weeks of disclosure, especially for a target as ubiquitous as a PDF reader. Treat this as pre-exploitation urgency.

Why annotation parsing matters to defenders

Annotation-heavy PDFs are normal in business workflows — legal review, engineering markup, finance approvals. That means you cannot simply block annotated PDFs at the gateway without breaking operations. The defensive burden falls on: (1) rapid patching, (2) behavioral detection on the endpoint for post-exploitation activity, and (3) constraining what the reader process is allowed to do.

Detection & Response

Since exploitation happens inside a legitimate signed binary (FoxitPDFReader.exe), signature-based detection on the exploit itself is unreliable. The durable detection strategy is post-exploitation behavior: a PDF reader should essentially never spawn child processes, write executables to user-writable locations, or make unusual outbound network connections. These are high-signal, low-noise analytics that catch this bug and the next one in the same class.

Sigma Rules

The following rules target the behavioral chain that follows successful client-side exploitation of Foxit PDF Reader. They are deliberately tight — a PDF reader spawning a shell or script interpreter is not something that happens in legitimate operation.

---
title: Foxit PDF Reader Spawning Suspicious Child Process
id: 8b2e4f17-3c9a-4d51-9e2a-6f7c1a0b3d45
status: experimental
description: Detects Foxit PDF Reader spawning shells, script interpreters, or LOLBins — a strong indicator of successful client-side exploitation such as CVE-2026-91818 (annotation use-after-free).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-746/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\FoxitPDFReader.exe'
      - '\Foxit Reader.exe'
      - '\FoxitPDFEditor.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
      - '\msiexec.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate Foxit operation does not spawn shells or script engines
level: critical
---
title: Foxit PDF Reader Writing Executable Content to User-Writable Paths
id: 3d7a9c24-5e1b-4f82-a6c8-2b9d0e4f7a16
status: experimental
description: Detects Foxit PDF Reader dropping executable or script payloads to temp, AppData, or Downloads directories — consistent with staged payload delivery after memory corruption exploitation.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-746/
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\Foxit Reader.exe'
      - '\FoxitPDFEditor.exe'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Users\Public\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.js'
      - '.jse'
      - '.vbs'
      - '.vbe'
      - '.ps1'
      - '.bat'
      - '.hta'
  condition: selection_image and selection_path and selection_ext
falsepositives:
  - Foxit updater activity (verify signed update paths and updater process lineage)
level: high
---
title: PDF Attachment Followed by Office or Script Execution from Email Client Context
id: 5c1f8b63-2a4d-4e97-b3f1-8d6e2c5a9b07
status: experimental
description: Detects a recently-delivered PDF opened from Outlook or browser download paths followed within a short window by execution of script interpreters, indicating a phish-delivered malicious document chain.
references:
  - https://attack.mitre.org/techniques/T1566.001/
  - http://www.zerodayinitiative.com/advisories/ZDI-26-746/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmdline:
    CommandLine|contains:
      - '\AppData\Local\Microsoft\Outlook\'
      - '\INetCache\'
      - '\Downloads\'
  selection_ext:
    CommandLine|contains:
      - '.pdf'
  selection_image:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\Foxit Reader.exe'
  condition: selection_cmdline and selection_ext and selection_image
falsepositives:
  - Users legitimately opening PDF attachments; use as correlation input, not standalone alert
level: low

KQL — Microsoft Sentinel / Defender

This query hunts for Foxit Reader exhibiting post-exploitation behavior across the fleet. It joins child-process execution with outbound network activity from the reader process — a combination that should be near-zero in a healthy environment.

// Hunt: Foxit PDF Reader post-exploitation behavior (CVE-2026-91818 class)
// Part 1: Suspicious child processes spawned by Foxit
let suspiciousChildren = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("FoxitPDFReader.exe", "Foxit Reader.exe", "FoxitPDFEditor.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "bitsadmin.exe", "certutil.exe", "msiexec.exe")
| project ChildTime=TimeGenerated, DeviceName, DeviceId, ChildProcess=FileName, ChildCmd=ProcessCommandLine,
    ParentCmd=InitiatingProcessCommandLine, AccountName, ReportId;
// Part 2: Outbound network connections from Foxit itself
let foxitNet = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("FoxitPDFReader.exe", "Foxit Reader.exe", "FoxitPDFEditor.exe")
| where RemoteIPType == "Public"
| summarize Connections=make_set(strcat(RemoteUrl, ":", RemotePort)), FirstConn=min(TimeGenerated), LastConn=max(TimeGenerated)
    by DeviceName, DeviceId, InitiatingProcessFileName;
// Correlate: devices showing both child process abuse and outbound connections
suspiciousChildren
| join kind=inner foxitNet on DeviceId
| project DeviceName, AccountName, ChildTime, ChildProcess, ChildCmd, FirstConn, LastConn, Connections
| sort by ChildTime asc

For environments ingesting Sysmon via SecurityEvent, an equivalent fleet-wide sweep for reader-spawned shells:

// Sysmon-ingested environments: Foxit spawning shells or LOLBins
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where ParentProcessName has_any ("FoxitPDFReader.exe", "Foxit Reader.exe", "FoxitPDFEditor.exe")
| where NewProcessName has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, Computer, SubjectUserName, ParentProcessName, NewProcessName, CommandLine
| sort by TimeGenerated desc

Velociraptor VQL

Use this artifact to sweep endpoints for active or recently-run Foxit processes with suspicious children, plus dropped executable artifacts in user-writable staging paths — useful during both hunting and triage of a suspected exploitation attempt.

-- Hunt: Foxit PDF Reader exploitation indicators (CVE-2026-91818 class)
-- Suspicious child processes of the Foxit reader process
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ '(?i)Foxit'
)
AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|wmic|certutil|bitsadmin|msiexec)'

-- Hunt: Executable/script content staged in user-writable paths (recent 72h)
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
    'C:/Users/*/AppData/Local/Temp/*.exe',
    'C:/Users/*/AppData/Local/Temp/*.dll',
    'C:/Users/*/AppData/Roaming/*.exe',
    'C:/Users/*/Downloads/*.exe',
    'C:/Users/Public/*.exe',
    'C:/Users/*/AppData/Local/Temp/*.ps1',
    'C:/Users/*/AppData/Local/Temp/*.hta'
])
WHERE Mtime > now() - 259200
ORDER BY Mtime DESC

Remediation / Verification Script

The following PowerShell script inventories Foxit installations across endpoints, flags out-of-date builds against a minimum approved version you set after confirming Foxit's patched release, and reports non-compliant hosts for remediation.

# CVE-2026-91818 — Foxit PDF Reader inventory and compliance check
# Set $MinApprovedVersion to the patched version from Foxit's security bulletin
# referenced at http://www.zerodayinitiative.com/advisories/ZDI-26-746/

$MinApprovedVersion = [version]"0.0.0.0"   # <-- UPDATE with Foxit's fixed build number
$report = @()

# Check installed Foxit products via registry uninstall keys (both hives)
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$foxit = Get-ItemProperty $uninstallPaths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Foxit' } |
    Select-Object DisplayName, DisplayVersion, InstallLocation, Publisher

if (-not $foxit) {
    Write-Output "[INFO] No Foxit products found on $env:COMPUTERNAME"
} else {
    foreach ($app in $foxit) {
        $installed = $null
        [void][version]::TryParse($app.DisplayVersion, [ref]$installed)
        $compliant = ($installed -ne $null) -and ($installed -ge $MinApprovedVersion)
        $report += [pscustomobject]@{
            Host        = $env:COMPUTERNAME
            Product     = $app.DisplayName
            Version     = $app.DisplayVersion
            Compliant   = $compliant
            CVE         = 'CVE-2026-91818'
        }
        if (-not $compliant) {
            Write-Warning "[VULNERABLE] $($app.DisplayName) $($app.DisplayVersion) on $env:COMPUTERNAME — update required"
        }
    }
}

# Export results for central collection
$report | Export-Csv -Path "C:\ProgramData\Foxit_CVE-2026-91818_Inventory.csv" -NoTypeInformation -Force
Write-Output $report

# Optional hardening: disable Foxit browser plugin DLLs until patched (reduces web-delivered attack surface)
$pluginDirs = @("$env:ProgramFiles\Foxit Software\Foxit PDF Reader\plugins",
                "${env:ProgramFiles(x86)}\Foxit Software\Foxit PDF Reader\plugins")
foreach ($dir in $pluginDirs) {
    if (Test-Path $dir) {
        Get-ChildItem $dir -Filter "*browser*" -ErrorAction SilentlyContinue | ForEach-Object {
            Rename-Item $_.FullName ($_.FullName + ".disabled") -Force
            Write-Output "[HARDENED] Disabled browser plugin: $($_.Name)"
        }
    }
}

Deploy this via your RMM, Intune, or GPO startup script across the fleet, and aggregate the CSV output into your vulnerability management platform to drive SLA tracking.

Remediation

1. Patch immediately. Apply the fixed Foxit PDF Reader build referenced in Foxit's security bulletin, linked from the ZDI advisory at http://www.zerodayinitiative.com/advisories/ZDI-26-746/. Do not rely on in-product auto-update alone — verify the installed version fleet-wide, because many enterprises disable auto-updaters. Track completion against your vulnerability SLA; a CVSS 7.8 client-side RCE in a document reader warrants an expedited (72-hour class) window given phishing exposure.

2. Inventory first. You cannot patch what you haven't counted. Foxit is frequently shadow-installed by users. Sweep uninstall registry keys, SoftwareInventory data, and EDR application inventory for all Foxit products — including Foxit PDF Editor and legacy Foxit PhantomPDF installs, which share parsing code.

3. Reduce attack surface while patching rolls out:

   • Configure email gateways to sandbox-detonate PDF attachments and strip or rewrite embedded URLs. Flag annotation-heavy PDFs from external senders for detonation priority.
   • Enable Attack Surface Reduction (ASR) rules in Microsoft Defender — particularly Block Office applications from creating child processes equivalents applied broadly, and Block executable files from running unless they meet a prevalence, age, or trusted list criterion. Consider custom ASR rules blocking child processes from Foxit executables.
   • Restrict Foxit Reader's ability to launch external applications and disable JavaScript in PDFs via Foxit's GPO/administrative template settings (DisableJavaScript), since JS is a common exploitation accelerant even when the root bug is memory corruption.

4. Browser-delivered PDFs. The advisory notes the target may "visit a malicious page." Where feasible, configure browsers to download PDFs rather than open them in an embedded Foxit plugin, or disable the plugin until the patch lands (see script above).

5. Hunt retroactively. Run the KQL queries above across at least the last 30 days. Memory corruption exploits in document readers are often delivered in low-volume, targeted campaigns — a single hit on the reader-spawning-shell analytic is a full IR trigger, not a tuning exercise.

6. Monitor CISA KEV. If CVE-2026-91818 lands in the Known Exploited Vulnerabilities catalog, your remediation deadline tightens by policy (BOD 22-01 timelines for federal agencies; use the same discipline commercially).

7. If compromise is suspected: isolate the host, capture memory before reboot (UAF exploits often leave no disk artifact of the initial payload — the reader process memory is your evidence), collect the suspect PDF and its delivery email headers, and preserve %LOCALAPPDATA%\Foxit crash dumps, which may contain the corrupt heap state useful for confirming exploitation.

The broader lesson: document readers are browser-class attack surface and deserve browser-class controls — rapid patching, child-process restrictions, sandbox detonation of inbound files, and behavioral analytics on the reader process. Organizations that treat PDF readers as "just another installed app" will keep re-learning this lesson with every advisory cycle.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub