What is the CVSS score of CVE-2026-57239?

CVE-2026-57239 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Foxit PDF Editor are affected by CVE-2026-57239?

Foxit PDF Editor and Reader on Windows contain an unpatched privilege escalation vulnerability (CVSS 7.8) enabling local users to gain administrative access.

How to fix or mitigate CVE-2026-57239?

24 hours: Identify all Windows systems running Foxit PDF Editor and Reader (all versions currently unpatched). 7 days: Restrict local administrative access and enforce principle of least privilege for user accounts. 30 days: Deploy application whitelisting; subscribe to Foxit security advisories weekly for patch notification; prepare patch deployment procedures.

Foxit PDF Editor CVE-2026-57239

EUVD-2026-42184 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-07-08 Foxit

GHSA-x8h2-84hg-x9j6

Information Disclosure Foxit Pdf Editor Foxit Pdf Reader Foxit Software Inc

7.8

CVSS 3.1 · NVD

Severity by source

Vendor (Foxit) PRIMARY

HIGH

qualitative

NVD

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.3 HIGH

A low-privileged local account is needed to plant the executable (PR:L) and a privileged process must run it (UI:R); local vector with total SYSTEM impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 09, 2026 - 14:45 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 09, 2026 - 14:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 09, 2026 - 14:37 vuln.today

cvss_changed

CVSS changed

Jul 09, 2026 - 14:37 NVD

8.2 (HIGH) 7.8 (HIGH)

Analysis Generated

Jul 08, 2026 - 09:11 vuln.today

DescriptionNVD

The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM.

Articles & Coverage 1

medium.com CVE-2026-57239: SYSTEM Privilege Escalation via Forged IPC in Foxit PDF Reader Update Service Aug 16, 2026

AnalysisAI

Local privilege escalation in Foxit PDF Editor and Foxit PDF Reader (Windows) lets a low-privileged user place executable files that a high-privilege process later runs directly, yielding code execution as NT AUTHORITY\SYSTEM. The flaw stems from an untrusted search path (CWE-427) where the application loads and executes attacker-writable binaries without validating their origin. There is no public exploit identified at time of analysis, EPSS is low (0.11%, 2nd percentile), and SSVC reports no observed exploitation, so this is a locally-exploitable escalation rather than a remotely wormable threat.

Technical ContextAI

Foxit PDF Editor and Foxit PDF Reader are widely used Windows desktop PDF applications and common Adobe Reader alternatives. The root cause is CWE-427 (Untrusted/Uncontrolled Search Path Element): a privileged Foxit component resolves and executes an executable from a location that a standard user can write to, so search-path resolution trusts a user-controllable directory. When a service, updater, or admin-triggered process running with elevated rights invokes that binary, it inherits the attacker's payload. Per the CPE data the affected products are cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader. Although the reporter tagged this 'Information Disclosure', the mechanics and CVSS impact (C:H/I:H/A:H, SYSTEM) are consistent with full privilege escalation rather than mere disclosure.

RemediationAI

Upgrade to the fixed Foxit builds published in the vendor security bulletin at https://www.foxit.com/support/security-bulletins.html - because the input lists only vulnerable ranges (Editor 2026.1.1/13.2.4/14.0.4 and earlier, Reader 2026.1.1 and earlier) and no exact fixed version, treat this as patch available per vendor advisory and install the next release above your branch as documented in that bulletin rather than an invented version number. As compensating controls until patched, restrict which users can write to Foxit's installation and working directories and remove user-writable entries from the effective search path so a standard user cannot stage a malicious executable (trade-off: may interfere with per-user auto-update); audit and lock down any Foxit scheduled task or service that runs elevated so it only executes signed binaries from protected paths; and enforce least privilege so untrusted users lack interactive local accounts on machines running Foxit. Confirm the exact fixed version against the Foxit bulletin before mass deployment.