Description

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-23T08:17:12.930Z",
  "pubdate": "2026-09-23T08:17:12.930Z",
  "executiveSummary": "This vulnerability involves a heap-based out-of-bounds (OOB) read within Foxit PDF Editor Reader, triggered by malformed PDF image object metadata. The issue stems from insufficient validation of compression parameters during the image decoding process. An attacker can exploit this flaw by supplying a specially crafted PDF document containing inconsistent compression metadata, which leads to the allocation of an undersized heap buffer.\nWhen the application attempts to render the image, the decoding routine performs read operations beyond the boundaries of the allocated memory. Successful exploitation typically results in an application crash, causing a Denial of Service (DoS). While primarily impacting availability, such OOB read vulnerabilities may theoretically facilitate information disclosure or serve as a primitive for more complex memory corruption exploits in specific environmental contexts. There are no authentication requirements for exploitation, and the attack is executed through the processing of a malicious PDF file, which can be delivered via email, web download, or other common file distribution vectors. Users should prioritize updating the software to the latest version to address this memory safety concern.",
  "technicalDetails": "The root cause of this vulnerability is improper boundary checking within the image decompression engine of Foxit PDF Editor Reader. The application fails to adequately sanitize or validate metadata fields associated with image objects defined in the PDF specification, specifically concerning compression algorithms and their expected stream lengths.\nThe attack flow begins when the PDF parser identifies an image object containing manipulated compression metadata. During the image decoding phase, the internal processing logic relies on these metadata fields to determine the necessary buffer size for the raw pixel data. Due to the lack of sufficient validation, the application calculates an insufficient buffer size for the output stream. This leads to an undersized allocation on the heap via the application's memory management subsystem.\nAs the decoder processes the compressed image stream, it performs read/write operations into this heap buffer. Because the metadata indicates an incorrect stream length or compression ratio relative to the actual data, the decoding routine eventually attempts to read source data or write output pixels past the end of the allocated buffer. In this instance, the OOB read occurs as the rendering engine accesses memory segments adjacent to the heap object.\nFrom an exploitation perspective, the triggering of an OOB read in the heap space can cause an immediate segmentation fault or access violation, resulting in a crash. If an attacker can control the contents of the memory surrounding the heap buffer—for example, through heap grooming or heap spraying techniques—the OOB read might be leveraged to leak sensitive data from adjacent heap chunks. This data could include pointers, sensitive user information, or configuration data that assists in bypassing security features such as Address Space Layout Randomization (ASLR).\nThe vulnerability is accessible to any user capable of opening a crafted document. No special privileges are required, and the attack does not rely on network connectivity, as the exploit is local to the parsing process upon file opening. The vulnerability highlights a breakdown in the trust boundary between the input metadata and the memory allocation routines, specifically where the image processing pipeline fails to enforce strict constraints on compressed data stream dimensions."
}