Loading story…
Foxit disclosed and patched CVE-2026-3775, a high-severity local privilege escalation vulnerability in the Foxit Reader/Editor Update Service that can let an authenticated low-privileged user execute code as SYSTEM. The flaw, tracked by the Zero Day Initiative as ZDI-26-251 and ZDI-CAN-28595, is an uncontrolled search path element issue (CWE-427) caused by the service loading libraries from unsecured locations, enabling DLL hijacking through malicious DLL planting.
The vulnerability carries a CVSS 7.8 rating and is considered particularly risky on shared Windows environments such as terminal servers, VDI, and multi-user workstations, where a standard user could elevate privileges without user interaction. Foxit released fixes across supported product branches, including versions such as 2026.1, 14.0.3, and 13.2.3, and defenders were urged to patch quickly, review writable DLL search-path locations, monitor for suspicious DLL files, and consider disabling the auto-update service until remediation is complete.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The Zero Day Initiative publicly disclosed CVE-2026-3775 / ZDI-26-251, describing a local privilege escalation vulnerability in Foxit PDF Reader caused by the update service loading a library from an unsecured location. The issue was credited to Erik Egsgard of Field Effect and assigned a CVSS score of 7.8.
Foxit remediated CVE-2026-3775, a DLL hijacking/uncontrolled search path flaw in the Foxit Reader/Editor Update Service that could let a low-privileged local attacker gain SYSTEM privileges. Reported fixed versions include 2026.1, 14.0.3, and 13.2.3 depending on product branch.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Foxit PDF Editor and Reader contain a high-severity local privilege escalation flaw, tracked as **`CVE-2026-57239`**, that can let a standard Windows user gain **`NT AUTHORITY\SYSTEM`** privileges after achieving code execution on a device. The issue affects versions **2026.1.1 and earlier**, **14.0.4 and earlier**, and **13.2.4 and earlier**, and stems from insecure updater behavior involving a user-writable AppData path, unsafe loading of **`winspool.drv`**, and a privileged update service, **`FoxitPDFReaderUpdateService.exe`**, that trusts a writable **`ProgramData`** control file. Researchers reported that the service could be abused through manipulation of **`FoxitData.txt`**, with valid encrypted instructions crafted because the binary used **AES-128-CBC** with a hardcoded key. Public disclosure by researcher Luke Paris, along with a GitHub proof of concept, has lowered the barrier to exploitation even though no confirmed in-the-wild abuse has been reported. Foxit assigned the CVE and patched the vulnerability in **version 2026.2**; defenders are being urged to update quickly and watch for changes to **`FoxitData.txt`**, suspicious files in Foxit AppData directories, and unusual SYSTEM-level processes spawned by the Foxit update service.
Jul 25, 2026
A local privilege escalation vulnerability, tracked as CVE-2025-13941, has been identified in the Foxit PDF Reader Update Service. The flaw arises from incorrect file system permissions assigned to resources during plugin installation, allowing a local attacker with low privileges to modify or replace these resources. If exploited, the attacker could execute arbitrary code with SYSTEM privileges, significantly increasing the risk of full system compromise. The vulnerability affects Foxit PDF Reader, and successful exploitation requires the attacker to have the ability to execute code with low privileges on the target system. Both the CVE advisory and the Zero Day Initiative confirm that the issue stems from the update service's mishandling of plugin resource permissions. The vulnerability was reported to Foxit in October 2025 and publicly disclosed in December 2025. Users are advised to consult Foxit's security bulletins for remediation steps and updates.
Jun 29, 2026
German authorities published advisories for **multiple vulnerabilities** affecting **Foxit PDF Reader** and **Foxit PDF Editor**, indicating ongoing security issues across the vendor's desktop PDF products. The notices identify separate advisory entries, `2026-0914` and `2026-1256`, covering flaws in both **Reader** and **Editor** and signaling that organizations using Foxit software should review the affected versions and available vendor guidance. The repeated disclosures suggest a broader patch-management concern for enterprises that rely on Foxit for document handling, particularly because PDF applications are common targets for malicious document-based exploitation. Security teams should prioritize validating installed Foxit versions, applying relevant updates, and monitoring for suspicious PDF-related activity on endpoints where Foxit Reader or Editor is deployed.
Jun 29, 2026