Foxit Pdf Editor CVE-2026-3775

Attacker requires local user account access on the target system. The application's update service must load system libraries from a search path including user-writable directories (not restricted to trusted system locations). No victim interaction required. Exploitation achieves SYSTEM privilege escalation via DLL/library hijacking.

Real-world risk is moderate-high for enterprise environments with shared workstations. The CVSS vector indicates local attack (AV:L) with low complexity (AC:L) requiring low privileges (PR:L) and no user interaction (UI:N), achieving full system compromise (C:H/I:H/A:H). This represents an easily exploitable post-compromise escalation vector once an attacker has initial low-privileged access through phishing, malware, or other means. The PR:L requirement means standard domain users can exploit this, making it dangerous in multi-user or terminal server environments. EPSS exploitation probability was not provided, limiting quantitative risk assessment. No CISA KEV listing indicates no confirmed active exploitation campaigns detected. No public exploit identified at time of analysis reduces immediate urgency, but DLL hijacking techniques are well-documented and easily reproducible by moderately skilled attackers. SSVC considerations: exploitation status is POC-likely (trivial to weaponize given public DLL hijacking frameworks), automatable (yes, can be scripted), technical impact is total system control. However, the local attack vector and authentication requirement limit blast radius compared to remote unauthenticated vulnerabilities. Priority depends heavily on organizational deployment density of Foxit products and privileged user practices. Organizations using Foxit PDF products in shared or sensitive environments should prioritize patching; those with single-user workstations and strong endpoint security may deprioritize slightly.

An attacker who has gained low-privileged access to a corporate workstation through a phishing campaign places a weaponized DLL with a common Windows library name (such as version.dll or dwmapi.dll) into the user's %TEMP% directory or another writable location in the DLL search path. When the Foxit PDF Reader update service automatically runs its scheduled update check with SYSTEM privileges, it loads the attacker's malicious DLL instead of the legitimate system library, executing arbitrary code with full administrative rights. The attacker's code disables security monitoring, establishes persistence through a scheduled task, and deploys additional post-exploitation tools for lateral movement across the network, all without triggering user account control prompts or requiring further authentication.