Foxit PDF Editor EUVD-2026-85161

Exploitation requires that the attacker already have LOCAL, low-privileged code execution on a system running Foxit PDF Editor or Reader, and that the software's auto-update mechanism performs a download-then-elevated-extract sequence. The concrete prerequisite is write access to the location where the update package is staged plus the ability to swap that file within the TOCTOU window between download and high-privilege extraction, exploiting the insufficient file locking and missing integrity validation. Limiting factors: no remote network vector (AV:L), the attacker must win a timing race (reducing reliability, consistent with SSVC Automatable: no), an update cycle must be in progress, and the affected versions are Foxit PDF Editor ≤14.0.7 / ≤13.2.6 / ≤2026.2 and Foxit PDF Reader ≤2026.2; patched builds are not vulnerable. No user interaction by a separate victim is required (UI:N).

This is a genuine but non-urgent local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local attacker with low privileges achieving full CIA impact - consistent with the CWE-367 TOCTOU race in the updater described by Foxit. Every exploitation signal points AWAY from active threat: EPSS is 0.13% (3rd percentile), CISA SSVC lists Exploitation as 'none' and Automatable as 'no' (though Technical Impact is 'total', matching the C:H/I:H/A:H), and there is no public exploit identified at time of analysis. The signals are therefore internally consistent - high technical impact but low likelihood - making this a patch-on-normal-cycle issue rather than an emergency, since an attacker must already have local low-privileged code execution on the host before this flaw buys them elevation. One honest caveat on my own scoring: the provided AC:L may understate difficulty, because TOCTOU exploitation requires winning a timing race against the download/extract window; SSVC's 'Automatable: no' supports that it is not trivially mass-exploitable. No KEV listing and no vendor exploitation claim exist.

A local, low-privileged user on a machine running Foxit PDF Editor or Reader waits for (or induces) the application's auto-update to download an installer package. During the gap between download and the high-privilege extraction step, the attacker replaces the package on disk with a malicious one because file locking and integrity validation are insufficient, causing the elevated updater to execute attacker-controlled code with elevated privileges. No public exploit is identified at time of analysis, so an attacker would need to develop the race themselves.