EUVD-2026-85166
GHSA-hh85-f5h8-q4pf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged local foothold
-
DeliveryPlant malicious DLL in user-writable updater path
-
ExploitUpdater runs high-privilege operation
-
ExecutionDLL loaded via unsafe search path
-
ImpactExecute code with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires: (1) the attacker already has local, low-privileged access to a Windows host where Foxit PDF Editor (≤14.0.7 / ≤2026.2) or Foxit PDF Reader (≤2026.2) is installed; (2) the ability to write a crafted DLL into a user-writable directory that the Foxit updater includes in its library search path; and (3) the Foxit updater subsequently performing a high-privilege operation that loads from that path (e.g., a triggered or scheduled update check). Limiting factors: no remote vector (AV:L) and no network exposure, so a pre-existing foothold is mandatory; the escalation only occurs when the privileged updater actually runs, and systems where the updater is disabled or where the load path is not user-writable are not exploitable. |
| Impact | This is a credible but non-urgent local privilege escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity attack that requires the attacker to already hold low-privilege access (PR:L) on the host, after which full confidentiality, integrity and availability impact is achievable - consistent with SSVC 'Technical Impact: total'. All exploitation-urgency signals, however, point low: EPSS is 0.17% (6th percentile), SSVC 'Exploitation: none' and 'Automatable: no', the CVE is not on CISA KEV, and no public exploit was supplied. These signals are mutually consistent - a high-impact-but-locally-scoped flaw that is not opportunistically exploitable at scale (DLL-planting PrivEsc requires prior foothold and cannot be automated across the internet). There is no conflict between CVSS and the description: both agree the vector is local. Net: a real defect worth patching in normal cycles, but not an emergency relative to remote, internet-facing bugs. Exploitation status: no public exploit identified at time of analysis. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged foothold on a Windows host running Foxit PDF Editor or Reader plants a malicious DLL in a user-writable directory from which the Foxit updater loads libraries. When the updater subsequently performs a high-privilege operation, it loads the attacker's DLL and executes the attacker's code with elevated privileges. No public proof-of-concept was provided, and no user interaction by a separate victim is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 08, 2026
Local privilege escalation in Foxit PDF Editor (14.0.7 and earlier, plus 2026.2 and earlier) and Foxit PDF Reader (2026.2 and earlier) allows a locally authenticated low-privileged attacker to plant a crafted DLL in a user-writable directory that the Foxit updater searches, so that when the updater performs a high-privilege operation the malicious library is loaded and code runs with elevated privileges. The flaw is a classic uncontrolled search path condition (CWE-427) with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a foothold on the Windows host - there is no remote or network vector - and exploitation only succeeds if the privileged updater actually runs and the relevant path is user-writable. Intelligence signals are quiet: no public exploit identified at time of analysis, no CISA KEV listing (SSVC exploitation: none, automatable: no), and a low EPSS of 0.17% (6th percentile), making this a credible but non-urgent post-compromise escalation issue rather than an imminent threat.
Earlier versions of this analysis (1)
Local privilege escalation in Foxit PDF Editor and Foxit PDF Reader allows an attacker who already holds a low-privileged local account on a Windows host to plant a malicious DLL that the product's updater loads while running with elevated privileges, resulting in code execution at SYSTEM or administrator level. The flaw is a classic uncontrolled search path issue (CWE-427) in the updater component, rated CVSS 3.1 base 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because exploitation is low-complexity, needs no user interaction once the DLL is staged, and crosses a privilege boundary to give high confidentiality, integrity, and availability impact. There is no remote attack path and initial local access is a hard prerequisite; no public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV) in the provided data.
RemediationAI
Patch available per vendor advisory: consult https://www.foxit.com/support/security-bulletins.html for the latest Foxit PDF Editor and Foxit PDF Reader builds beyond the affected ranges (Editor 14.0.7 and earlier, Editor 2026.2 and earlier, Reader 2026.2 and earlier) and deploy the current release through your normal software distribution process, since the precise fixed version number is not confirmed in the available data. If immediate upgrading is not possible, the most effective compensating control is to remove the write condition the attack depends on: verify and harden ACLs on the Foxit installation directory and any user-writable folders the updater resolves libraries from, so non-administrators cannot create or replace DLLs there - the trade-off is that third-party installers or users accustomed to writing to those paths may break if permissions are tightened too broadly. Disabling or unregistering the Foxit updater service/scheduled task removes the high-privilege load entirely, but it also stops automatic security updates, so pair it with a documented manual update cadence that includes periodic checks of the Foxit bulletin page. Additional hardening with low operational cost includes enforcing application control or DLL-load monitoring (for example Sysmon image-load events or EDR rules flagging DLLs loaded by the Foxit updater from user-writable locations) to detect attempted hijacks, and restricting interactive logon on hosts running Foxit to trusted users, which reduces but does not eliminate exposure because exploitation requires only an existing low-privileged account.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a DLL search-order hijacking issue (CWE-427, uncontrolled search path element) in the Foxit updater component shared by Foxit PDF Editor and Foxit PDF Reader. When the updater runs with elevated rights - for example during a scheduled or user-triggered update check - it resolves dependent dynamic-link libraries using a search path that includes a directory writable by ordinary local users. Because Windows loads libraries from the first matching path, an attacker who can create a file at the expected name can substitute arbitrary code that inherits the updater's higher privilege level, yielding local privilege escalation rather than code execution in the attacker's existing context. The affected platform is Windows, and the CPE inventory confirms the impacted code base as cpe:2.3:a:foxit_software_inc.:foxit_pdf_editor:*:*:*:*:*:*:*:* and cpe:2.3:a:foxit_software_inc.:foxit_pdf_reader:*:*:*:*:*:*:*:*; the CVSS vector's PR:L and AV:L components match the assessed prerequisite of an existing low-privileged local account and no UI interaction beyond the updater's normal behavior.
Know when Foxit Pdf Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local DLL-planting (AV:L) by an already-present low-privileged user (PR:L), low complexity, no victim interaction, yielding full SYSTEM-level C/I/A within an unchanged scope.
Primary rating from Vendor (Foxit).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges.
Executive ViewAI
Foxit PDF Editor and Reader deployments on Windows create a risk that an attacker already present on an endpoint could escalate from user-level access to administrative control of that device. Leadership should care because this could expose sensitive data, allow system tampering, and support lateral movement from compromised workstations, even though no public exploit or active exploitation has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict write access to Foxit installation and update directories; remove or harden user-writable directories from the updater search path; run the Foxit updater with least privilege or disable it where operationally acceptable; enforce application control or DLL-search-order protections; monitor for unexpected DLLs loaded by Foxit updater processes; and investigate any signs of local privilege escalation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Foxit Pdf Editor
View allContent spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementa
Local privilege escalation in Foxit PDF Editor for macOS allows an attacker with a low-privilege foothold to execute arb
A local privilege escalation vulnerability in the auto-update daemon shipped with Foxit PDF Editor and Foxit PDF Reader
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic
Path traversal in the attachment-handling logic of Foxit PDF Editor and Foxit PDF Reader lets a crafted PDF write an emb
An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered w
Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF t
Insufficient validation of embedded-resource file paths in Foxit PDF Editor and Foxit PDF Reader (CVE-2026-91801) lets a
Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that i
Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption
Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image d
A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects
Exploit-DB