The vulnerability identified as CVE-2026-91796 in Foxit PDF Editor/Reader involves a protection mechanism failure (CWE-693). The software's interface does not verify permissions correctly for secure reading mode, enabling malicious PDFs to initiate external SMB authentication requests silently. This behavior can lead to the leakage of hashed user credentials. The CVSS 3.1 base score is 6.1, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact.

An attacker can craft a PDF that, when opened in Foxit PDF Editor/Reader, triggers an external SMB authentication request without any security prompt to the user. This can result in the leakage of the user's credential hash to the attacker. The confidentiality impact is limited to credential hash exposure, with no direct integrity impact, but the availability impact is rated high. There is no evidence of active exploitation in the wild.

No patch or official remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should exercise caution when opening PDFs from untrusted sources and consider disabling external resource loading features if possible until a fix is released.