What is the CVSS score of CVE-2026-3775?

CVE-2026-3775 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Foxit Pdf Editor are affected by CVE-2026-3775?

Foxit PDF Editor and Foxit PDF Reader update services contain a DLL search path hijacking vulnerability that allows authenticated local users to escalate privileges to SYSTEM level.

How to fix or mitigate CVE-2026-3775?

Within 24 hours: Identify all endpoints running Foxit PDF Editor and Foxit PDF Reader using inventory tools; disable auto-update features in both applications until a patch is released. Within 7 days: restrict write permissions on system directories where Foxit processes execute; implement AppLocker or similar controls to prevent unsigned DLL loading in Foxit process contexts. Within 30 days: monitor Foxit security advisories for patched versions; establish a process to apply security updates immediately upon release; evaluate migration to alternative PDF readers if Foxit remains unpatched.

Foxit Pdf Editor CVE-2026-3775

EUVD-2026-17751 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-04-01 Foxit

GHSA-j35c-qjxf-46vc

Privilege Escalation RCE Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 01:45 euvd

EUVD-2026-17751

Analysis Generated

Apr 01, 2026 - 01:45 vuln.today

CVE Published

Apr 01, 2026 - 01:40 nvd

HIGH 7.8

DescriptionCVE.org

The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these libraries may be resolved and loaded from user‑writable locations, a local attacker can place a malicious library there and have it loaded with SYSTEM privileges, resulting in local privilege escalation and arbitrary code execution.

AnalysisAI

DLL search path hijacking in Foxit PDF Editor and Foxit PDF Reader update services enables local privilege escalation to SYSTEM. Low-privileged authenticated users can plant malicious libraries in writable directories that are resolved during update checks, achieving arbitrary code execution with elevated privileges. CVSS 7.8 (High) with low attack complexity. No public exploit identified at time of analysis, EPSS data not provided.

Technical ContextAI

This vulnerability exploits CWE-427 (Uncontrolled Search Path Element), commonly known as DLL hijacking or binary planting on Windows systems. The Foxit update service fails to implement secure DLL loading practices, specifically not restricting library resolution to trusted system directories or using mechanisms like SetDllDirectory() or SafeDllSearchMode. When the update service runs with SYSTEM privileges and checks for updates, it searches for required DLLs through a path that includes user-writable locations (such as %TEMP%, current working directory, or application directories with lax permissions). The Windows loader resolves libraries in search order, and if a malicious DLL is placed in an earlier-searched writable location with the correct name, it will be loaded and executed in the security context of the update service. The affected products per CPE data are Foxit PDF Editor (cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor) and Foxit PDF Reader (cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader), both widely-deployed PDF manipulation applications. This class of vulnerability is persistent in Windows applications that perform privileged operations without hardening DLL loading behavior.

RemediationAI

Organizations should immediately review the Foxit Security Bulletins page at https://www.foxit.com/support/security-bulletins.html for patch availability and specific remediation guidance. Patch available per vendor advisory; apply the latest security updates for Foxit PDF Editor and Foxit PDF Reader as released by Foxit Software. Until patching is complete, implement defense-in-depth controls including removing write permissions from non-administrative users on Foxit installation directories, enforcing application whitelisting to prevent unauthorized DLL execution, and monitoring for suspicious library loading behavior via EDR solutions. Consider temporarily disabling automatic update functionality if the service cannot be secured, though this creates operational security debt. In high-security environments, restrict Foxit product deployment to single-user workstations with full disk encryption and run endpoint privilege management solutions to prevent initial low-privileged access that enables exploitation. Validate post-patch that update services no longer load libraries from user-writable paths through process monitoring tools like Process Monitor or Sysmon event ID 7 (image loaded) analysis.