EUVD-2026-85122
GHSA-3jfq-gmmh-mj79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local unprivileged access to macOS host
-
DeliveryModify user-writable installer configuration value
-
ExploitTrigger high-privilege Foxit upgrade
-
ExecutionInstaller consumes value without validation
-
ImpactExecute arbitrary commands as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Requires a local low-privilege foothold on a macOS system with Foxit PDF Editor installed (PR:L, AV:L), plus write access to a user-modifiable configuration value that the installer trusts, and the occurrence of a high-privilege installer upgrade that consumes that value. Exploitation is limited by these prerequisites: the attacker cannot reach this remotely, must already execute code as a local user, and depends on a privileged upgrade operation being triggered. No victim user interaction is needed (UI:N). |
| Impact | The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.8) describes a low-complexity local privilege escalation requiring an existing low-privilege foothold on a macOS host - not a remote or network-reachable flaw. There is no EPSS score, no CISA KEV listing, and no public POC identified in the provided data; exploitation status is therefore 'no public exploit identified at time of analysis'. The high 8.8 stems entirely from full C/I/A impact (root code execution) plus the vendor's S:C (scope change) choice, NOT from ease of reach - an attacker must already be able to log in or run code locally as an unprivileged user. I question the S:C assignment: escalating a local user to root stays within the same OS security authority, which conventionally scores S:U, dropping the base to ~7.8; verify scope framing with Foxit. This is a genuine local root escalation worth patching on multi-user or shared macOS fleets, but it is not a mass-exploitable, internet-facing priority - realistic risk is bounded by the prerequisite local access and the need to trigger a high-privilege installer upgrade. |
| Exploit ScenarioDerived | A local unprivileged user on a macOS machine running Foxit PDF Editor modifies a configuration value that the installer trusts, then triggers (or waits for) a high-privilege upgrade of the application. The installer consumes the tampered value without validation and executes attacker-controlled commands as root, granting full system control. No public exploit code is available at time of analysis, and no user interaction from a victim is required (UI:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arbitrary commands as root by tampering with a user-modifiable configuration value that the installer trusts during high-privilege upgrades. Exploitation requires local access, write access to the configuration value, and a privileged upgrade operation to be triggered, but no user interaction (UI:N) is needed. No public exploit code or active exploitation has been identified at time of analysis (no KEV, no POC).
RemediationAI
Patch available per vendor advisory: consult the Foxit security bulletins page at https://www.foxit.com/support/security-bulletins.html for the exact fixed version and update Foxit PDF Editor for macOS to the latest release. If immediate patching is not possible, restrict write access to installer-related configuration files to root only, ensuring that non-privileged users cannot modify values that the installer consumes during privileged upgrades; note that this may interfere with per-user settings or automated deployment scripts. Additionally, avoid triggering high-privilege upgrades while untrusted local users are present, or perform upgrades only from a trusted administrative account after verifying configuration integrity. Monitor for unexpected root-level process execution originating from the installer.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource). The Foxit PDF Editor for macOS installer improperly trusts a configuration value that can be modified by a local user. During a high-privilege upgrade (e.g., when the installer runs with root privileges), the installer reads this value and uses it without sufficient validation, enabling an attacker to inject arbitrary commands that execute with root privileges. The CPE cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor:*:*:*:*:*:*:*:* indicates the affected product is Foxit PDF Editor, and all versions are potentially affected unless patched. This is a local privilege escalation: the attacker must already have code execution as a low-privilege user on the macOS host (PR:L) and be able to write to the configuration value. The CVSS vector reflects local access (AV:L), low attack complexity (AC:L), no user interaction (UI:N), and high impact to confidentiality, integrity, and availability. The independent assessment rates scope as unchanged (S:U) despite the original vector indicating scope change (S:C); the practical impact remains privilege escalation to root.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local foothold gives AV:L/PR:L; the flaw yields root code execution (C/I/A:H) but stays within one OS authority, so S:U rather than the vendor's S:C.
Primary rating from Vendor (Foxit).
CVSS VectorVendor: Foxit
DescriptionCVE.org
A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges.
Executive ViewAI
Foxit PDF Editor for macOS carries a local privilege-escalation flaw that allows an attacker already present on a Mac with limited rights to gain full root control during a privileged upgrade. The exposure is concentrated on Mac endpoints where the product is installed, with the greatest concern for executives, developers, and IT administrators whose machines hold sensitive data or elevated trust. Leadership should treat this as an endpoint-hardening and monitoring priority rather than a broad internet-facing exposure, since exploitation requires an attacker to already have a foothold on the device.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or restrict local administrator and standard-user write access to Foxit configuration and installer preference paths; enforce least privilege and separation of duties on macOS endpoints; require signed, MDM-controlled installation and upgrade workflows rather than user-initiated privileged upgrades; deploy EDR detections for Foxit updater/installer processes spawning root-level commands or unexpected child processes; and consider uninstalling, sandboxing, or replacing Foxit PDF Editor on high-value endpoints until a fix is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Specially crafted PDFs can trigger a use-after-free in Foxit PDF Reader and Editor when JavaScript is enabled, leading t
Exploit-DB