What is the CVSS score of CVE-2026-57239?

CVE-2026-57239 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Editor are affected by CVE-2026-57239?

Foxit PDF Editor and Reader on Windows contain an unpatched privilege escalation vulnerability (CVSS 7.8) enabling local users to gain administrative access.

How to fix or mitigate CVE-2026-57239?

24 hours: Identify all Windows systems running Foxit PDF Editor and Reader (all versions currently unpatched). 7 days: Restrict local administrative access and enforce principle of least privilege for user accounts. 30 days: Deploy application whitelisting; subscribe to Foxit security advisories weekly for patch notification; prepare patch deployment procedures.

Foxit PDF Editor CVE-2026-57239

EUVD-2026-42184 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-07-08 Foxit

GHSA-x8h2-84hg-x9j6

Information Disclosure Foxit Pdf Editor Foxit Pdf Reader

7.8

CVSS 3.1 · NVD

Severity by source

Vendor (Foxit) PRIMARY

HIGH

qualitative

NVD

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.3 HIGH

A low-privileged local account is needed to plant the executable (PR:L) and a privileged process must run it (UI:R); local vector with total SYSTEM impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 09, 2026 - 14:45 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 09, 2026 - 14:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 09, 2026 - 14:37 vuln.today

cvss_changed

CVSS changed

Jul 09, 2026 - 14:37 NVD

8.2 (HIGH) 7.8 (HIGH)

Analysis Generated

Jul 08, 2026 - 09:11 vuln.today

DescriptionNVD

The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM.

AnalysisAI

Local privilege escalation in Foxit PDF Editor and Foxit PDF Reader (Windows) lets a low-privileged user place executable files that a high-privilege process later runs directly, yielding code execution as NT AUTHORITY\SYSTEM. The flaw stems from an untrusted search path (CWE-427) where the application loads and executes attacker-writable binaries without validating their origin. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-privilege local account

Delivery

Plant malicious executable in user-writable search path

Exploit

High-privilege Foxit process resolves attacker file

Execution

Privileged process executes planted binary

Impact

Code runs as NT AUTHORITY\SYSTEM

Access

Obtain low-privilege local account

Delivery

Plant malicious executable in user-writable search path

Exploit

High-privilege Foxit process resolves attacker file

Execution

Privileged process executes planted binary

Impact

Code runs as NT AUTHORITY\SYSTEM

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to already have a local, low-privileged account on a Windows host with Foxit PDF Editor or Foxit PDF Reader installed, plus write access to the directory from which a high-privilege Foxit process resolves and executes an executable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are internally consistent and point to a genuine but locally-scoped issue rather than an urgent internet-facing emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A low-privileged user on a shared Windows workstation drops a malicious executable into a directory that Foxit's elevated helper process searches, then waits for or triggers the privileged process to run it. When the high-privilege process executes the planted binary, the attacker's code runs as NT AUTHORITY\SYSTEM, giving full host control. …
Remediation	Upgrade to the fixed Foxit builds published in the vendor security bulletin at https://www.foxit.com/support/security-bulletins.html - because the input lists only vulnerable ranges (Editor 2026.1.1/13.2.4/14.0.4 and earlier, Reader 2026.1.1 and earlier) and no exact fixed version, treat this as patch available per vendor advisory and install the next release above your branch as documented in that bulletin rather than an invented version number. … Detailed patch versions, workarounds, and compensating controls in full report.