Description

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-23T08:17:13.190Z",
  "pubdate": "2026-09-23T08:17:13.190Z",
  "executiveSummary": "A heap-based out-of-bounds (OOB) read vulnerability has been identified within the Foxit PDF Editor and Reader rendering engine.\nThe vulnerability stems from flawed logic when processing malformed PDF image masks, specifically regarding alpha-channel metadata.\nAn unauthenticated, remote attacker can exploit this by enticing a victim to open a specially crafted, malicious PDF document.\nSuccessful exploitation results in an OOB read, which triggers an application crash (Denial of Service).\nWhile the primary impact described is application termination, heap-based OOB read vulnerabilities in document processors can occasionally be leveraged to leak sensitive memory contents, potentially facilitating subsequent code execution attacks if chained with memory corruption primitives.\nThere are no specific privilege requirements for the initial trigger; however, the attacker relies on social engineering to deliver the malicious payload to the target system.",
  "technicalDetails": "The vulnerability resides in the image processing component of the Foxit PDF rendering pipeline, specifically during the handling of PDF image mask objects.\nWhen a PDF document defines an image mask with inconsistent metadata, the internal rendering engine fails to validate the correlation between the specified image dimensions, the alpha-channel structure, and the allocated heap buffer size.\nDuring the parsing of these objects, the application allocates a heap buffer based on initial metadata values. If the subsequent alpha-channel processing logic encounters data that diverges from the initial parameters, it performs read operations beyond the allocated memory boundaries.\nThe root cause is an improper bounds check following the reconciliation of image metadata, leading to the processor attempting to read from memory addresses outside the scope of the allocated image buffer.\nThe attack flow commences when a user opens a malicious PDF file. The file is structured to include malformed metadata for an image mask object. Upon reaching the rendering phase, the Foxit engine parses the object, allocates the heap memory, and initiates the alpha-channel reconstruction process.\nBecause the engine relies on the malformed metadata for pointer arithmetic during this reconstruction, the read pointer moves into unallocated or unauthorized memory segments.\nThis unauthorized read access leads to an access violation, ultimately causing the application to crash.\nIn scenarios where memory layout can be predicted or manipulated via heap grooming, this vulnerability may allow an attacker to read adjacent heap data, potentially exposing sensitive information such as pointers, configuration data, or cryptographic keys stored in the memory space of the Foxit PDF process.\nThis vulnerability is reachable without authentication, requiring only the victim to open the file locally or via a web browser-integrated PDF viewer. There is no specific prerequisite for user privilege elevation, as the process runs within the security context of the logged-in user."
}