CVE-2026-91790

Overview

CVE-2026-91790 is a Use-After-Free flaw in PDF viewer software that can crash or allow remote code execution when handling specific image, annotation, JavaScript array, page, or form field objects. The vulnerability occurs due to improper validation of freed objects, potentially exposing sensitive data or enabling attackers to execute code. It carries a high severity rating with a CVSS v3 score of 8.1.

Description

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling certain image objects, annotation objects, JavaScript array objects, page objects, or form fields, which attackers could exploit to disclose information or execute remote code. This occurs due to the access to an object that has been freed or released without proper validation.

Impact

Confidentiality may be compromised if attackers disclose data from freed objects. Integrity can be affected if malicious code is executed to alter system state. Availability is impacted through application crashes that disrupt workflow. Defenders should monitor for anomalous PDF processing and enforce strict sandboxing.

Remediation

Apply vendor patches that fix the UAF in PDF parsing. If no patch is available, disable JavaScript in the PDF viewer, restrict image/annotation handling, or use a sandboxed viewer. Enforce least privilege and restrict file permissions. Keep PDF viewer updated.

Risk context

High severity CVSS 8.1 indicates significant risk. No EPSS data available. Defenders should treat this as a high-priority issue and apply patches promptly.

Affected products

• Adobe Acrobat
• Foxit Reader
• PDF-XChange Editor
• Nitro PDF
• Okular
• Evince
• MuPDF
• SumatraPDF