Description

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:13.307Z",
  "pubdate": "2026-09-23T08:17:13.307Z",
  "executiveSummary": "This vulnerability is identified as a heap-based out-of-bounds (OOB) write flaw residing within the PRC (Product Representation Compact) parser of Foxit PDF Editor and Foxit PDF Reader.\nThe vulnerability occurs due to the application's failure to adequately validate vertex indices when processing triangular fan texture meshes embedded within PDF documents.\nA remote attacker can leverage this flaw by supplying a specially crafted PDF file containing malicious PRC data. When the application parses this data, it triggers a memory corruption event, leading to an uncontrolled write operation outside of the allocated heap buffer boundaries.\nThe primary impact of this vulnerability is an application crash, resulting in a denial-of-service (DoS) condition. Furthermore, heap-based memory corruption vulnerabilities often provide primitives that could potentially be leveraged for arbitrary code execution (ACE) if combined with other exploitation techniques.\nSuccessful exploitation requires the user to open a malicious file with the vulnerable software. No specific authentication is required, as the vulnerability is triggered during the standard document rendering process.",
  "technicalDetails": "The vulnerability is localized within the PRC parser module responsible for interpreting 3D mesh data encapsulated in PDF files. PRC files utilize a structured format for 3D geometry, including support for triangular fans.\nThe root cause is an integer validation failure within the logic processing the vertex indexing array for triangular fans. During the parsing of a triangular fan, the software iterates through the provided index list to fetch vertex coordinates. If the indices provided in the malicious PRC stream are not validated against the actual size of the allocated vertex buffer, the parser calculates an incorrect memory offset based on the out-of-bounds index value.\nThe attack flow commences when a user opens a malicious PDF document containing an embedded 3D annotation using the PRC format. Upon encountering the malformed triangular fan definition, the parser retrieves the malicious index value. Because the sanity check on the index value is missing or insufficient, the application computes an address outside the intended heap memory region allocated for the mesh data.\nThe subsequent write operation attempts to store vertex or texture coordinate data at this calculated out-of-bounds address. Since this memory address points to a location not intended for this specific data, it results in the corruption of adjacent heap metadata or adjacent object data. This uncontrolled heap modification frequently causes the heap manager to enter an inconsistent state, leading to an immediate process crash when the allocator next attempts to manage the corrupted memory chunks.\nFrom an exploitation perspective, this heap-based OOB write provides an attacker with a primitive to modify adjacent heap objects. If the attacker can control the layout of the heap (heap grooming), they might overwrite function pointers or object vtables present in the vicinity of the OOB write. By redirecting control flow to attacker-controlled memory, the impact could escalate from a simple crash to remote code execution under the context of the user running the Foxit application."
}