Loading vulnerability…
CVE-2026-57239 is a local privilege escalation vulnerability affecting Foxit PDF Reader and Foxit PDF Editor on Windows. The flaw arises because high-privilege processes directly execute executable files that are controllable by a low-privilege user. This creates an execution path in which an unprivileged local attacker can influence what binary is launched by a privileged process, resulting in execution in the security context of NT AUTHORITY\SYSTEM. Reported affected versions include Foxit PDF Editor 2026.1.1 and earlier, 14.0.4 and earlier, 13.2.4 and earlier, and Foxit PDF Reader 2026.1.1 and earlier.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a Rust-based Windows local privilege escalation exploit targeting Foxit PDF Reader updater-related vulnerabilities, explicitly referencing CVE-2026-3775, CVE-2026-3780, and CVE-2026-57239. It is a real exploit, not just a detector. The project contains a main executable and a separately built malicious DLL payload. Repository structure: the top-level crate (`src/main.rs`, `src/ipc.rs`) implements the operator-facing CLI and the Foxit-specific trigger logic. `build.rs` automatically builds the secondary `elevator` crate and embeds the resulting `elevator.dll` into the main binary with `include_bytes!`. The `elevator` subproject (`elevator/src/lib.rs`) is the actual payload DLL that executes when side-loaded. Main exploit capabilities: the executable supports `check`, `exploit`, and `cleanup` commands. `check` reads the version metadata from `FoxitPDFReader.exe` using the `pelite` PE parser and decides whether the target is likely vulnerable and which technique to use. `exploit` either auto-detects or accepts a chosen technique, writes the malicious DLL into the Foxit updater addon directory under the current user's roaming profile, and triggers Foxit updater behavior by writing a crafted encrypted IPC message to `C:\ProgramData\Foxit Software\Foxit PDF Reader\FoxitData.txt`. `cleanup` removes dropped payload files. Foxit-specific logic: `src/ipc.rs` reconstructs Foxit's IPC format. It uses a hardcoded AES-128-CBC key (`YzZjNzcwMmRiY2Jm`) and a zero IV to encrypt a payload containing `sessionid`, `strTempUpdaterPath`, and `csCommandLine`. The command line includes updater-related arguments, the Foxit reader path, a Foxit registry path, and a version string. This indicates the exploit is designed to impersonate or drive the normal updater workflow rather than exploit a memory corruption bug. Privilege escalation payload: once the dropped DLL is loaded, `elevator/src/lib.rs` runs from `DllMain`, enables `SeDebugPrivilege` and `SeImpersonatePrivilege`, enumerates processes, opens process tokens, identifies a SYSTEM token by checking for SID `S-1-5-18`, duplicates that token with `DuplicateTokenEx`, and launches `cmd.exe` on `WinSta0\Default` using `CreateProcessWithTokenW`. The DLL also exports `ClosePrinter`, `OpenPrinterW`, and `DocumentPropertiesW`, which is consistent with masquerading as a printer-related library for side-loading compatibility. Techniques implemented: for older versions, the exploit drops the payload as `winspool.drv` and immediately triggers the updater. For newer but still vulnerable versions, it first triggers the updater, then drops `secur32.dll`, and instructs the user to click a link in the updater dialog to complete the side-load path. This makes the exploit operational but somewhat environment-dependent and partially interactive for one technique. No network communication, remote C2, or external URLs are present. The attack surface is entirely local and file/IPC based, centered on Foxit installation paths, updater directories, and Windows token manipulation APIs.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Foxit PDF Reader that, based on the title, appears to enable privilege escalation.
A local privilege escalation vulnerability in Foxit PDF Editor and Foxit PDF Reader on Windows where user-controllable executable files can be directly executed by high-privilege processes, potentially allowing elevation to NT AUTHORITY\SYSTEM.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.