Loading story…
Foxit PDF Editor and Reader contain a high-severity local privilege escalation flaw, tracked as CVE-2026-57239, that can let a standard Windows user gain NT AUTHORITY\SYSTEM privileges after achieving code execution on a device. The issue affects versions 2026.1.1 and earlier, 14.0.4 and earlier, and 13.2.4 and earlier, and stems from insecure updater behavior involving a user-writable AppData path, unsafe loading of winspool.drv, and a privileged update service, FoxitPDFReaderUpdateService.exe, that trusts a writable ProgramData control file.
Researchers reported that the service could be abused through manipulation of FoxitData.txt, with valid encrypted instructions crafted because the binary used AES-128-CBC with a hardcoded key. Public disclosure by researcher Luke Paris, along with a GitHub proof of concept, has lowered the barrier to exploitation even though no confirmed in-the-wild abuse has been reported. Foxit assigned the CVE and patched the vulnerability in version 2026.2; defenders are being urged to update quickly and watch for changes to FoxitData.txt, suspicious files in Foxit AppData directories, and unusual SYSTEM-level processes spawned by the Foxit update service.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Foxit remediated CVE-2026-57239 in version 2026.2 of its PDF software. Reporting states there was no confirmed in-the-wild exploitation at the time of disclosure.
Foxit assigned identifier CVE-2026-57239 to the privilege escalation vulnerability affecting Foxit PDF Editor/Reader. The flaw impacts versions 2026.1.1 and earlier, 14.0.4 and earlier, and 13.2.4 and earlier.
Researcher Luke Paris publicly disclosed the local privilege escalation vulnerability CVE-2026-57239 on the Paradoxis blog and released proof-of-concept code on GitHub. The disclosure described how Foxit update components could be abused to escalate from a local user context to NT AUTHORITY\SYSTEM.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceblog.paradoxis.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Foxit disclosed and patched **CVE-2026-3775**, a high-severity local privilege escalation vulnerability in the **Foxit Reader/Editor Update Service** that can let an authenticated low-privileged user execute code as **SYSTEM**. The flaw, tracked by the Zero Day Initiative as **ZDI-26-251** and **ZDI-CAN-28595**, is an uncontrolled search path element issue (**CWE-427**) caused by the service loading libraries from unsecured locations, enabling **DLL hijacking** through malicious DLL planting. The vulnerability carries a **CVSS 7.8** rating and is considered particularly risky on shared Windows environments such as terminal servers, VDI, and multi-user workstations, where a standard user could elevate privileges without user interaction. Foxit released fixes across supported product branches, including versions such as **2026.1**, **14.0.3**, and **13.2.3**, and defenders were urged to patch quickly, review writable DLL search-path locations, monitor for suspicious DLL files, and consider disabling the auto-update service until remediation is complete.
Jun 29, 2026
A local privilege escalation vulnerability, tracked as CVE-2025-13941, has been identified in the Foxit PDF Reader Update Service. The flaw arises from incorrect file system permissions assigned to resources during plugin installation, allowing a local attacker with low privileges to modify or replace these resources. If exploited, the attacker could execute arbitrary code with SYSTEM privileges, significantly increasing the risk of full system compromise. The vulnerability affects Foxit PDF Reader, and successful exploitation requires the attacker to have the ability to execute code with low privileges on the target system. Both the CVE advisory and the Zero Day Initiative confirm that the issue stems from the update service's mishandling of plugin resource permissions. The vulnerability was reported to Foxit in October 2025 and publicly disclosed in December 2025. Users are advised to consult Foxit's security bulletins for remediation steps and updates.
Jun 29, 2026
German authorities published advisories for **multiple vulnerabilities** affecting **Foxit PDF Reader** and **Foxit PDF Editor**, indicating ongoing security issues across the vendor's desktop PDF products. The notices identify separate advisory entries, `2026-0914` and `2026-1256`, covering flaws in both **Reader** and **Editor** and signaling that organizations using Foxit software should review the affected versions and available vendor guidance. The repeated disclosures suggest a broader patch-management concern for enterprises that rely on Foxit for document handling, particularly because PDF applications are common targets for malicious document-based exploitation. Security teams should prioritize validating installed Foxit versions, applying relevant updates, and monitoring for suspicious PDF-related activity on endpoints where Foxit Reader or Editor is deployed.
Jun 29, 2026