Description

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-23T08:17:12.807Z",
  "pubdate": "2026-09-23T08:17:12.807Z",
  "executiveSummary": "This vulnerability is identified as a heap-based out-of-bounds (OOB) read within Foxit PDF Editor and Reader. The flaw stems from insufficient input validation during the parsing of malformed image soft-mask data, which triggers an arithmetic underflow during memory allocation or offset calculation.\nThe vulnerability allows an unauthenticated, remote attacker to trigger an application crash or potentially leak sensitive information from the process heap memory. Successful exploitation requires a victim to open a specially crafted malicious PDF file containing malformed image attributes. The risk is significant as it affects the core rendering engine of the PDF application, potentially enabling further exploitation chains if the OOB read is leveraged to bypass security controls such as Address Space Layout Randomization (ASLR).\nGiven that PDF parsers are frequently targeted for remote code execution, this memory corruption issue should be considered high-risk. Mitigation requires updating to the latest vendor-supplied patch, as no effective local mitigations can address the fundamental flaw in the image parsing logic.",
  "technicalDetails": "The root cause of this vulnerability lies in the image parsing module of Foxit PDF Editor/Reader, specifically in the logic responsible for interpreting the 'soft-mask' (SMask) attribute within an image object's dictionary. The parser fails to properly sanitize or validate the dimensions and data length attributes provided in the PDF document stream.\nDuring the processing of the image stream, the application performs arithmetic operations on the soft-mask data attributes to allocate heap memory for the image buffer. If the provided values are manipulated to be inconsistent with the actual data stream, an arithmetic underflow occurs during the size calculation. This result leads to an undersized allocation on the heap.\nThe exploitation flow begins when an attacker distributes a weaponized PDF file. When the user opens the file, the Foxit engine parses the malicious image dictionary. The underflow-induced small heap allocation creates a discrepancy between the allocated buffer size and the memory address pointer used to write or read the processed image data. When the parser proceeds to copy the image pixels or soft-mask transparency data into the heap, it proceeds to read or write beyond the intended bounds of the allocated buffer.\nThis out-of-bounds read allows the attacker to access data residing in adjacent memory segments within the heap. In a real-world attack scenario, this can be used to read sensitive objects stored in the heap, such as function pointers, object metadata, or other document-related structures. By carefully crafting the heap layout, an attacker may be able to gain information regarding the heap structure or the location of specific libraries, which is a critical precursor to bypassing ASLR and achieving arbitrary code execution in more complex exploit chains.\nThe vulnerability does not require prior authentication or elevated privileges; it is triggered entirely by the application's native parsing logic upon encountering the malformed document. The impact is primarily a Denial of Service (DoS) due to memory access violations leading to an application crash, but the potential for memory disclosure remains a severe security concern."
}