Foxit PDF Editor/Reader CVE-2026-91812

Exploitation requires the attacker to occupy a man-in-the-middle position on the network path carrying Foxit PDF Editor/Reader's software-update traffic, and the victim client must perform an update check/download while under that interception. The specific weakness is that the update mechanism fails to properly validate the TLS certificate and the integrity/signature of the downloaded update package (CWE-295), allowing a forged update to be accepted. No authentication to the product is required (PR:N) and no user interaction is needed (UI:N), but exploitation is materially limited by the privileged-network-position prerequisite (reflected as AC:H) and by the timing dependency on an update occurring - making it realistic mainly on untrusted networks (public Wi-Fi, compromised gateways) rather than against arbitrary internet-exposed targets. Affected builds include Foxit PDF Editor 2026.2 and earlier, 14.0.7 and earlier, 13.2.6 and earlier, and Foxit PDF Reader 2026.2 and earlier.

This is a genuinely high-impact but hard-to-exploit issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, score 8.1) reflects total compromise potential (system-privilege arbitrary code execution) but explicitly rates Attack Complexity as High because the attacker must first achieve a privileged man-in-the-middle position on the victim's update traffic - a precondition the attacker cannot guarantee. The supporting signals reinforce 'serious but not urgent': EPSS is very low at 0.13% (3rd percentile), there is no CISA KEV listing, no public exploit identified, and CISA SSVC rates Exploitation as 'none' and Automatable as 'no' while confirming Technical Impact as 'total.' In short, the high CVSS is driven by impact, not by ease or likelihood of exploitation. This should be patched on a normal prioritized cycle (high impact, broad install base) rather than treated as an emergency; the MITM prerequisite and non-automatable nature make opportunistic mass exploitation unlikely, with realistic threat limited to targeted scenarios where an adversary already controls a network path (hostile Wi-Fi, compromised router, ISP/state-level interception).

An attacker who controls a network path to the victim (e.g., a malicious public Wi-Fi access point or a compromised router) intercepts Foxit's software-update traffic. Because certificate validation and package integrity checks can be bypassed, the attacker substitutes a malicious update package that Foxit installs and executes with system privileges. No public exploit code is known at the time of analysis, and the attack requires the victim's client to actually perform an update check while under interception.