CVE-2026-91796 in PDF Editor
Summary
by MITRE • 09/23/2026
The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
Foxit PDF Editor and Reader contain a critical access control vulnerability within their implementation of Secure Reading Mode. This feature is designed to provide an isolated environment for viewing sensitive documents, typically by disabling interactive elements such as scripts, hyperlinks, and external network requests to prevent data exfiltration or malicious code execution. However, the application fails to enforce strict permission verification when processing certain types of embedded content within PDF files. Specifically, the software does not adequately restrict interactions with file system resources or network protocols that require authentication credentials, even when operating in a restricted security context. This architectural flaw allows specially crafted Portable Document Format files to bypass the intended sandboxing mechanisms and initiate external connections without user consent or notification.
The technical mechanism of this vulnerability relies on the application's handling of Uniform Resource Locators embedded within PDF objects. When a malicious document contains references to SMB (Server Message Block) shares, Foxit PDF Editor/Reader attempts to resolve these network paths by initiating an authentication handshake with the target server. Crucially, because Secure Reading Mode does not properly validate whether such external resource access is permitted under its security policy, the application proceeds with the connection attempt automatically. During this process, Windows operating systems typically engage in NTLM (NT LAN Manager) or Kerberos authentication protocols to verify user identity against the remote SMB share. Since no security prompt appears to alert the user that their credentials are being transmitted externally, the interaction occurs silently and invisibly to the end-user.
The operational impact of this flaw is severe, primarily concerning credential theft through hash leakage. When the application initiates the authentication request with a maliciously controlled SMB server, it transmits the current user's NTLMv2 challenge-response hash as part of the standard protocol handshake. This hash can be captured by an attacker controlling the destination server and subsequently subjected to offline brute-force or dictionary attacks to recover the plaintext password. Unlike direct credential harvesting where usernames and passwords are explicitly sent in cleartext, this method exploits the inherent trust relationships between client machines and network resources. The victim remains unaware that their authentication material has been compromised until significant damage occurs, such as unauthorized access to other systems within the corporate domain using the cracked credentials.
This vulnerability aligns with CWE-284 Improper Access Control, specifically regarding insufficient verification of authorization for critical functions before execution. It also maps directly to MITRE ATT&CK technique T1076 Remote File Share Access, where adversaries use SMB shares to access files or execute commands on remote systems. In this context, the exploitation vector is slightly different as it focuses on credential harvesting rather than direct file manipulation, but the underlying principle of abusing trusted network connections remains consistent with T1558 Steal or Forge Kerberos Tickets and T1076 in terms of lateral movement potential if the credentials are successfully cracked. The lack of user notification further exacerbates the risk by removing a critical layer of human-based detection that might otherwise interrupt the attack chain.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Users should immediately update Foxit PDF Editor and Reader to the latest version provided by the vendor, as patches for this specific access control flaw have been released in subsequent security advisories. In environments where updating is not immediately feasible, administrators can implement network-level controls such as blocking outbound SMB traffic from workstations that do not require it, thereby preventing the connection to malicious external servers. Additionally, enabling advanced auditing on domain controllers and endpoint detection systems may help identify unusual authentication patterns indicative of hash capture attempts. Organizations should also enforce strict policies regarding the execution of untrusted documents, utilizing application whitelisting or sandboxing solutions that operate at a level deeper than the PDF reader's internal security mode to ensure isolation is maintained regardless of software-specific bugs.