Loading vulnerability…
CVE-2026-57239 is a local privilege-escalation vulnerability in Foxit PDF Editor and Foxit PDF Reader for Windows. A privileged Foxit update service can directly execute an executable from a user-controllable location. The updater's unsafe loading of an attacker-supplied driver-style module can then be combined with the service-triggered execution to run attacker-controlled code as NT AUTHORITY\SYSTEM. Affected releases include PDF Editor 2026.1.1 and earlier, 14.0.4 and earlier, and 13.2.4 and earlier, and PDF Reader 2026.1.1 and earlier.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a Rust-based Windows local privilege escalation exploit targeting Foxit PDF Reader updater-related vulnerabilities, explicitly referencing CVE-2026-3775, CVE-2026-3780, and CVE-2026-57239. It is a real exploit, not just a detector. The project contains a main executable and a separately built malicious DLL payload. Repository structure: the top-level crate (`src/main.rs`, `src/ipc.rs`) implements the operator-facing CLI and the Foxit-specific trigger logic. `build.rs` automatically builds the secondary `elevator` crate and embeds the resulting `elevator.dll` into the main binary with `include_bytes!`. The `elevator` subproject (`elevator/src/lib.rs`) is the actual payload DLL that executes when side-loaded. Main exploit capabilities: the executable supports `check`, `exploit`, and `cleanup` commands. `check` reads the version metadata from `FoxitPDFReader.exe` using the `pelite` PE parser and decides whether the target is likely vulnerable and which technique to use. `exploit` either auto-detects or accepts a chosen technique, writes the malicious DLL into the Foxit updater addon directory under the current user's roaming profile, and triggers Foxit updater behavior by writing a crafted encrypted IPC message to `C:\ProgramData\Foxit Software\Foxit PDF Reader\FoxitData.txt`. `cleanup` removes dropped payload files. Foxit-specific logic: `src/ipc.rs` reconstructs Foxit's IPC format. It uses a hardcoded AES-128-CBC key (`YzZjNzcwMmRiY2Jm`) and a zero IV to encrypt a payload containing `sessionid`, `strTempUpdaterPath`, and `csCommandLine`. The command line includes updater-related arguments, the Foxit reader path, a Foxit registry path, and a version string. This indicates the exploit is designed to impersonate or drive the normal updater workflow rather than exploit a memory corruption bug. Privilege escalation payload: once the dropped DLL is loaded, `elevator/src/lib.rs` runs from `DllMain`, enables `SeDebugPrivilege` and `SeImpersonatePrivilege`, enumerates processes, opens process tokens, identifies a SYSTEM token by checking for SID `S-1-5-18`, duplicates that token with `DuplicateTokenEx`, and launches `cmd.exe` on `WinSta0\Default` using `CreateProcessWithTokenW`. The DLL also exports `ClosePrinter`, `OpenPrinterW`, and `DocumentPropertiesW`, which is consistent with masquerading as a printer-related library for side-loading compatibility. Techniques implemented: for older versions, the exploit drops the payload as `winspool.drv` and immediately triggers the updater. For newer but still vulnerable versions, it first triggers the updater, then drops `secur32.dll`, and instructs the user to click a link in the updater dialog to complete the side-load path. This makes the exploit operational but somewhat environment-dependent and partially interactive for one technique. No network communication, remote C2, or external URLs are present. The attack surface is entirely local and file/IPC based, centered on Foxit installation paths, updater directories, and Windows token manipulation APIs.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A local privilege escalation vulnerability in Foxit PDF Reader caused by insecure interactions between the updater component and a privileged Windows service, enabling attackers with local code execution to gain SYSTEM privileges via crafted instructions and sideloading/proxy module loading.
A local privilege escalation vulnerability in Foxit PDF Reader’s updater/service architecture that can allow a low-privileged Windows user with prior code execution to gain SYSTEM-level execution by abusing writable files and unsafe module loading in the updater flow.
A high-severity local privilege escalation vulnerability in Foxit PDF Editor/Reader that can allow a local unprivileged user to obtain NT AUTHORITY\SYSTEM privileges by abusing Foxit update components and sideloading behavior.
A vulnerability in Foxit PDF Reader that, based on the title, appears to enable privilege escalation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.