EUVD-2026-42184
GHSA-x8h2-84hg-x9j6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local account
-
DeliveryPlant malicious executable in user-writable search path
-
ExploitHigh-privilege Foxit process resolves attacker file
-
ExecutionPrivileged process executes planted binary
-
ImpactCode runs as NT AUTHORITY\SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires the attacker to already have a local, low-privileged account on a Windows host with Foxit PDF Editor or Foxit PDF Reader installed, plus write access to the directory from which a high-privilege Foxit process resolves and executes an executable. It is gated by user interaction (UI:R): a privileged process - such as an elevated Foxit service, updater, or admin-triggered action - must actually run the attacker-controlled file for escalation to occur. Limiting factors: no remote or network exploitation (AV:L), no exposure to unauthenticated internet attackers, dependence on the specific privileged execution path in vulnerable versions (Editor ≤2026.1.1/≤13.2.4/≤14.0.4, Reader ≤2026.1.1), and reliance on the target having a high-privilege Foxit component present and invoked. |
| Impact | The signals are internally consistent and point to a genuine but locally-scoped issue rather than an urgent internet-facing emergency. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (base 7.8) indicates local access with user interaction and total impact, matching SSVC Technical Impact = total. However, EPSS is only 0.11% (2nd percentile), SSVC Exploitation = none and Automatable = no, and it is not in CISA KEV - so despite the high CVSS the near-term exploitation likelihood is low. One tension: NVD scores PR:N, but the description explicitly requires a 'low-privilege user' to stage the executable, implying the attacker already holds a local account (closer to PR:L in practice); AV:L plus UI:R further limit this to attackers with an existing local foothold. Net: prioritize for endpoint patching as a defense-in-depth escalation fix, but it is not a drop-everything remote threat. |
| Exploit ScenarioDerived | A low-privileged user on a shared Windows workstation drops a malicious executable into a directory that Foxit's elevated helper process searches, then waits for or triggers the privileged process to run it. When the high-privilege process executes the planted binary, the attacker's code runs as NT AUTHORITY\SYSTEM, giving full host control. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 09, 2026
Local privilege escalation in Foxit PDF Editor and Foxit PDF Reader (Windows) lets a low-privileged user place executable files that a high-privilege process later runs directly, yielding code execution as NT AUTHORITY\SYSTEM. The flaw stems from an untrusted search path (CWE-427) where the application loads and executes attacker-writable binaries without validating their origin. There is no public exploit identified at time of analysis, EPSS is low (0.11%, 2nd percentile), and SSVC reports no observed exploitation, so this is a locally-exploitable escalation rather than a remotely wormable threat.
Earlier versions of this analysis (2)
Local privilege escalation in Foxit PDF Reader and Foxit PDF Editor (Windows) lets a low-privileged user gain NT AUTHORITY\SYSTEM by planting a user-controllable executable or library that a high-privilege Foxit process loads and runs. Rated CVSS 7.8, the flaw is an uncontrolled search path element (CWE-427, DLL/binary planting) requiring local access and user interaction, with no public exploit identified at time of analysis. EPSS is low (0.11%, 2nd percentile) and CISA SSVC scores exploitation as 'none', so this is a real but non-urgent local escalation rather than a remotely wormable threat.
Local privilege escalation in Foxit PDF Editor and Foxit PDF Reader for Windows allows a low-privilege user to gain NT AUTHORITY\SYSTEM by placing a user-controllable executable that a high-privilege Foxit process then launches directly. The flaw affects Foxit PDF Reader/Editor 2026.1.1 and earlier, plus Editor branches 13.2.4 and 14.0.4 and earlier, and was reported by Foxit itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
RemediationAI
Upgrade to the fixed Foxit builds published in the vendor security bulletin at https://www.foxit.com/support/security-bulletins.html - because the input lists only vulnerable ranges (Editor 2026.1.1/13.2.4/14.0.4 and earlier, Reader 2026.1.1 and earlier) and no exact fixed version, treat this as patch available per vendor advisory and install the next release above your branch as documented in that bulletin rather than an invented version number. As compensating controls until patched, restrict which users can write to Foxit's installation and working directories and remove user-writable entries from the effective search path so a standard user cannot stage a malicious executable (trade-off: may interfere with per-user auto-update); audit and lock down any Foxit scheduled task or service that runs elevated so it only executes signed binaries from protected paths; and enforce least privilege so untrusted users lack interactive local accounts on machines running Foxit. Confirm the exact fixed version against the Foxit bulletin before mass deployment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Foxit PDF Editor and Foxit PDF Reader are widely used Windows desktop PDF applications and common Adobe Reader alternatives. The root cause is CWE-427 (Untrusted/Uncontrolled Search Path Element): a privileged Foxit component resolves and executes an executable from a location that a standard user can write to, so search-path resolution trusts a user-controllable directory. When a service, updater, or admin-triggered process running with elevated rights invokes that binary, it inherits the attacker's payload. Per the CPE data the affected products are cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader. Although the reporter tagged this 'Information Disclosure', the mechanics and CVSS impact (C:H/I:H/A:H, SYSTEM) are consistent with full privilege escalation rather than mere disclosure.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A low-privileged local account is needed to plant the executable (PR:L) and a privileged process must run it (UI:R); local vector with total SYSTEM impact.
Primary rating from Vendor (Foxit).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM.
Articles & Coverage 1
Executive ViewAI
Foxit PDF Editor and Reader on Windows contain an unpatched privilege escalation vulnerability (CVSS 7.8) enabling local users to gain administrative access. While no active exploitation has been identified (EPSS 0.1%), the absence of a vendor patch creates persistent insider risk and expands attacker post-breach impact if they obtain initial system access.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) enforce principle of least privilege and restrict local administrative access; (2) deploy application whitelisting and code integrity policies to prevent unauthorized executable execution; (3) monitor Foxit installation directories for suspicious file creation; (4) virtualize or sandbox PDF processing for sensitive documents; (5) subscribe to Foxit security advisories for timely patch release notification.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB