Foxit Pdf Editor CVE-2026-3780

Requires local user access to a system where the application installer runs with elevated privileges and resolves executables/DLLs from user-writable directories (e.g., current working directory, %PATH% including user directories). Victim must execute the installer. Affects Windows systems with insecure DLL/executable search path configurations.

The CVSS base score of 7.3 (High) accurately reflects significant impact potential, with the vector showing local attack requirement (AV:L), low complexity (AC:L), low privileges required (PR:L), and user interaction needed (UI:R). The attack requires an authenticated local user to plant the malicious DLL before an administrator or another user runs the installer, which provides a practical barrier but remains realistic in shared workstation or enterprise deployment scenarios. The UI:R component indicates an administrator must actively initiate the installation process, limiting opportunistic exploitation but not preventing targeted attacks. EPSS probability data is not available for this CVE, preventing quantitative likelihood assessment, but the vulnerability class (DLL search path hijacking) has well-established exploitation patterns in the security community. No public exploit identified at time of analysis and absence from CISA KEV indicates this is not confirmed as actively exploited in the wild, substantially reducing immediate urgency compared to KEV-listed vulnerabilities. The SSVC framework would likely categorize this as low-to-moderate priority for most organizations: exploitation status is none known, automatability is low due to the requirement for pre-positioning files before a specific user action, but technical impact is total (complete system compromise possible). Real-world risk is highest in environments with shared endpoints, frequent software installations by multiple users, or where standard users can write to directories checked during installer execution. Organizations using enterprise deployment tools that run installers silently or Foxit products deployed to high-value targets should prioritize remediation, while those with strict application control and limited installation events face lower practical risk despite the high CVSS score.

An attacker with standard user credentials on a shared Windows workstation identifies that Foxit PDF Reader is scheduled for installation or upgrade by IT staff. Prior to the installation event, the attacker places a malicious DLL named to match a common system library (such as version.dll) in the user's temp directory or current working directory that will be active when the installer runs. When an administrator executes the Foxit installer, the installer's elevated process loads the attacker's malicious DLL instead of the legitimate system file due to Windows DLL search order precedence. The malicious code executes with SYSTEM or Administrator privileges, allowing the attacker to create a new administrative account, install persistent backdoors, disable security controls, or exfiltrate sensitive data from protected system areas. No public exploit identified at time of analysis, but the DLL search path attack technique is well-documented with numerous public tools available to automate discovery and exploitation of such vulnerabilities.