rootpwn

high · CVSS v3 7.8

CVE-2026-91795

Addressed a potential issue where the application could be exposed to an Untrusted Pointer Dereference vulnerability whe…

Description

Addressed a potential issue where the application could be exposed to an Untrusted Pointer Dereference vulnerability when opening a crafted PDF containing a malicious FOPN_foweb encryption filter with the FileOpen plugin, which attackers could exploit to execute arbitrary code. This occurs due to a lack of proper validation of the encryption metadata, leaving an internal pointer in an invalid state and resulting in chained read and write access violations.

Scores

Severity
high
CVSS v2
6.8
CVSS v3
7.8
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-91789

Adobe Acrobat Reader and related PDF processing components are vulnerable to an out-of-bounds read/write when parsing malformed U3D, PRC, AcroForms, JPEG/JPEG2000, or annotation streams. The flaw can cause crashes or remote code execution, potentially exposing sensitive data or allowing attackers to compromise systems. It is critical for organizations that rely on PDF handling to apply patches promptly.

View analysis

high

CVE-2026-91790

CVE-2026-91790 is a Use-After-Free flaw in PDF viewer software that can crash or allow remote code execution when handling specific image, annotation, JavaScript array, page, or form field objects. The vulnerability occurs due to improper validation of freed objects, potentially exposing sensitive data or enabling attackers to execute code. It carries a high severity rating with a CVSS v3 score of 8.1.

View analysis

high

CVE-2026-91791

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling certain image objects, annotation objects, JavaScript array objects, page objects, or form fields, which attackers could exploit to disclose information or execute remote code. This occurs due to the access to an object that has been freed or released without proper validation.

View analysis

high

CVE-2026-91792

Addressed potential issues where the application could be exposed to a Use-After-Free vulnerability and crash when handling certain image objects, annotation objects, JavaScript array objects, page objects, or form fields, which attackers could exploit to disclose information or execute remote code. This occurs due to the access to an object that has been freed or released without proper validation.

View analysis