Loading story…
A local privilege escalation vulnerability, tracked as CVE-2025-13941, has been identified in the Foxit PDF Reader Update Service. The flaw arises from incorrect file system permissions assigned to resources during plugin installation, allowing a local attacker with low privileges to modify or replace these resources. If exploited, the attacker could execute arbitrary code with SYSTEM privileges, significantly increasing the risk of full system compromise.
The vulnerability affects Foxit PDF Reader, and successful exploitation requires the attacker to have the ability to execute code with low privileges on the target system. Both the CVE advisory and the Zero Day Initiative confirm that the issue stems from the update service's mishandling of plugin resource permissions. The vulnerability was reported to Foxit in October 2025 and publicly disclosed in December 2025. Users are advised to consult Foxit's security bulletins for remediation steps and updates.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-13941 was publicly disclosed as a high-severity local privilege escalation vulnerability affecting Foxit PDF Reader/Editor. Advisories described that incorrect file system permissions during plugin installation could allow local resource modification or replacement and lead to arbitrary code execution with SYSTEM privileges.
A local privilege escalation flaw in the Foxit PDF Reader/Editor Update Service was reported to Foxit. The issue involved incorrect permissions on plugin-related resources that could let a low-privileged local attacker gain SYSTEM-level code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Foxit disclosed and patched **CVE-2026-3775**, a high-severity local privilege escalation vulnerability in the **Foxit Reader/Editor Update Service** that can let an authenticated low-privileged user execute code as **SYSTEM**. The flaw, tracked by the Zero Day Initiative as **ZDI-26-251** and **ZDI-CAN-28595**, is an uncontrolled search path element issue (**CWE-427**) caused by the service loading libraries from unsecured locations, enabling **DLL hijacking** through malicious DLL planting. The vulnerability carries a **CVSS 7.8** rating and is considered particularly risky on shared Windows environments such as terminal servers, VDI, and multi-user workstations, where a standard user could elevate privileges without user interaction. Foxit released fixes across supported product branches, including versions such as **2026.1**, **14.0.3**, and **13.2.3**, and defenders were urged to patch quickly, review writable DLL search-path locations, monitor for suspicious DLL files, and consider disabling the auto-update service until remediation is complete.
Jun 29, 2026
Foxit PDF Editor and Reader contain a high-severity local privilege escalation flaw, tracked as **`CVE-2026-57239`**, that can let a standard Windows user gain **`NT AUTHORITY\SYSTEM`** privileges after achieving code execution on a device. The issue affects versions **2026.1.1 and earlier**, **14.0.4 and earlier**, and **13.2.4 and earlier**, and stems from insecure updater behavior involving a user-writable AppData path, unsafe loading of **`winspool.drv`**, and a privileged update service, **`FoxitPDFReaderUpdateService.exe`**, that trusts a writable **`ProgramData`** control file. Researchers reported that the service could be abused through manipulation of **`FoxitData.txt`**, with valid encrypted instructions crafted because the binary used **AES-128-CBC** with a hardcoded key. Public disclosure by researcher Luke Paris, along with a GitHub proof of concept, has lowered the barrier to exploitation even though no confirmed in-the-wild abuse has been reported. Foxit assigned the CVE and patched the vulnerability in **version 2026.2**; defenders are being urged to update quickly and watch for changes to **`FoxitData.txt`**, suspicious files in Foxit AppData directories, and unusual SYSTEM-level processes spawned by the Foxit update service.
Jul 25, 2026
German authorities published advisories for **multiple vulnerabilities** affecting **Foxit PDF Reader** and **Foxit PDF Editor**, indicating ongoing security issues across the vendor's desktop PDF products. The notices identify separate advisory entries, `2026-0914` and `2026-1256`, covering flaws in both **Reader** and **Editor** and signaling that organizations using Foxit software should review the affected versions and available vendor guidance. The repeated disclosures suggest a broader patch-management concern for enterprises that rely on Foxit for document handling, particularly because PDF applications are common targets for malicious document-based exploitation. Security teams should prioritize validating installed Foxit versions, applying relevant updates, and monitoring for suspicious PDF-related activity on endpoints where Foxit Reader or Editor is deployed.
Jun 29, 2026