CVE-2026-91814 in PDF Editor
Summary
by MITRE • 09/23/2026
A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The identified security flaw resides within Foxit PDF Editor and Reader, specifically affecting the cryptographic verification logic applied to incrementally updated Portable Document Format files. Incremental updates are a standard feature of the PDF specification that allows for modifications such as digital signatures or form field data without rewriting the entire file structure. This mechanism is designed to preserve existing content while appending new changes at the end of the document stream. However, in this specific implementation, the signature validation engine fails to properly account for these incremental updates when determining the integrity of a previously signed section. Consequently, if an attacker modifies visible document content through such an update, the cryptographic hash used to validate the digital signature remains unchanged relative to its original state, leading the application to incorrectly report that the document is still validly signed despite having been altered.
This technical deficiency creates a severe risk for content spoofing and integrity compromise. Because the software continues to display the document as authentic, users are misled into trusting information that has been maliciously modified. This can be exploited in various attack scenarios where trust relies heavily on digital signatures, such as financial transactions, legal contracts, or official certifications. An adversary could alter key figures in a financial report, change terms and conditions in a contract, or modify instructions in technical documentation while maintaining the appearance of authenticity. The persistence of the valid signature status undermines the fundamental purpose of digital signing, which is to provide assurance that content has not been tampered with since it was signed by the authorized party.
From an industry standards perspective, this vulnerability aligns closely with CWE-345, Insufficient Verification of Data Authenticity, as the application fails to verify that all relevant data corresponds to its expected state before accepting a signature as valid. It also relates to CWE-829, Inclusion of Functionality from Untrusted Control Sphere, if the incremental update mechanism is manipulated via untrusted input sources. Furthermore, this exploitation technique maps to MITRE ATT&CK tactic T1563, Remote Service Data Manipulation, where an attacker alters data in transit or storage to achieve a malicious objective without detection by standard integrity checks. The lack of proper validation during the signature verification process represents a critical failure in applying secure coding principles for cryptographic operations.
To mitigate this risk, immediate action is required from both end-users and software vendors. Users should exercise caution when opening PDF documents that contain digital signatures, particularly those received via email or downloaded from untrusted sources, until patches are applied. It is advisable to verify the signature status using multiple independent tools rather than relying solely on a single application's validation output. For organizations, implementing strict input validation and ensuring that all software components are updated to versions where this flaw has been remediated is essential. The vendor must address the underlying logic error by ensuring that any incremental update triggers a re-evaluation of the entire document signature chain, thereby invalidating signatures if any part of the visible content or metadata structure has changed since signing.