CVE-2026-91812 is an improper certificate validation flaw in the update mechanism of Foxit PDF Reader and Editor on Windows. A man in the middle on the local network can bypass certificate and package integrity checks, which may lead to code running as SYSTEM. NVD scores it High (7.9). Update to 2026.2.1 or 14.0.8.
What's affected
Foxit's bulletin dated 23 September 2026 lists Reader 2026.2.0.39747 and earlier, and Editor 2026.2.0.39747 and earlier on 2026.x, plus the 2025, 2024, 2023, 14.x and 13.x lines up to the versions named in the bulletin. The platform is Windows. Fixed releases are Reader 2026.2.1 and Editor 2026.2.1 or 14.0.8.
The weakness is CWE-295, improper certificate validation. The vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. The attack vector is adjacent network, so the attacker must sit on the same network segment, and user interaction is required. Foxit rates it Important at 7.9, the same as the record.
How to check if you're exposed
Open Help, then About in the Foxit product to read the version, and compare it with the fixed releases. Use Check for Update in the same menu.
Think about where updates happen. Laptops that check for updates on hotel, cafe or guest Wi-Fi are the case the adjacent network vector describes. Offices where updates come from a managed deployment tool are less exposed.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Update to Foxit PDF Reader 2026.2.1, or Foxit PDF Editor 2026.2.1 or 14.0.8, from a network you trust.
- Deploy the update centrally if you can, and turn off user-initiated updates on untrusted networks.
- Avoid running updaters on public Wi-Fi until patched.
- Inventory old Foxit installs and remove the ones you no longer use.
Why it matters
An updater is a program that downloads code and runs it with high privilege, so it must be certain who it is talking to and that the package is intact. The bulletin says certificate validation and package integrity checks could be bypassed by an attacker positioned in the network path. If both checks fail, a forged update is as good as a signed one.
The score is held below the highest range because the attacker must be on the same network and the user must act, and the complexity is high. Still, the changed scope and SYSTEM level result are why it earns a high rating. The record's KEV flag is false and the bulletin does not report exploitation.
Quick check
Who can exploit this?
Someone on the same network segment as the victim who can intercept update traffic, plus a user action, per the vector.
Does the fix cover the other updater issues?
The bulletin lists several updater flaws fixed in the same releases.
Sources
Last reviewed: 18 October 2026.
