Foxit PDF Editor EUVD-2026-85167

Requires an existing local, unprivileged user session on a host running Foxit PDF Editor or Foxit PDF Reader with the vulnerable auto-update daemon installed and its insecurely-permissioned configuration file present. The concrete prerequisite is that the update daemon's configuration file is modifiable by regular (non-admin) users, and that the daemon subsequently runs with elevated privileges to read and act on that file. Limiting factors: no remote vector (AV:L) - the attacker must already be on the machine (PR:L); exploitation depends on the daemon actually being installed and scheduled to run; and environments that harden or remove the auto-updater, or that have applied Foxit's fix, are not affected. No user interaction by a victim is required (UI:N).

The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 8.8) describes a classic local privilege escalation: an already-authenticated low-privileged local user (PR:L, AV:L) abuses weak filesystem permissions (CWE-732) on the update daemon's configuration file to run arbitrary script content in the daemon's higher-privilege (likely SYSTEM/root) context, producing full C:H/I:H/A:H with a scope change (S:C) as the impact crosses from the user to the elevated service. This is a genuine, high-quality finding but NOT a mass-exploitation emergency: exploitation requires an existing local foothold, so it is a post-compromise escalation primitive rather than an internet-facing entry point. No EPSS score, no CISA KEV entry, and no public POC were provided in the input, so there is no evidence of active exploitation - under an SSVC lens this reads as 'exploitation: none, automatable: no (local, requires prior access), technical impact: total.' The single vendor reference (Foxit security bulletins) is self-reported, which is consistent with a coordinated disclosure and patch rather than an observed attack. Net: real and worth patching promptly on managed fleets because of the total technical impact, but its practical priority is bounded by the local-access precondition.

An attacker who already has an unprivileged local account (or malware running as a standard user) writes malicious script/command content into the Foxit update daemon's world-writable configuration file. When the auto-update daemon next runs with elevated privileges, it reads the tampered configuration and executes the attacker-controlled script, granting SYSTEM/root-level code execution. No public exploit code is identified in the provided data, and no user interaction is required (UI:N).