CVE-2026-91796 MEDIUM

CVE-2026-91796: Foxit PDF Editor/Reader importIcon NTLM Response Information Disclosure Vulnerability

Vendor Foxit Software Inc.
Product Foxit PDF Editor
Weakness CWE-693
Published September 23, 2026
Last update September 23, 2026
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

What the vulnerability does

01Description

The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials.

Key dates

02Disclosure timeline

September 23, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2025-12094 OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing CVE-2024-0680 WP Private Content Plus <= 3.6 - Protection Mechanism Bypass CVE-2023-0085 Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass CVE-2025-11260 WP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism Bypass CVE-2024-11197 Lock User Account <= 1.0.5 - User Lock Bypass