Description
A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions are assigned to resources used by the update service. A local attacker with low privileges could modify or replace these resources, which are later executed by the service, resulting in execution of arbitrary code with SYSTEM privileges.
Metrics
CVSS 3.1 8.8/10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Foxit Software Inc. | Foxit PDF Reader | Versions 2025.2.1 and earlier; Versions 14.0.1 and earlier; Versions 13.2.1 and eariler |
| Foxit Software Inc. | Foxit PDF Editor | Versions 2025.2.1 and earlier; Versions 14.0.1 and earlier; Versions 13.2.1 and eariler |
References
- https://www.foxit.com/support/security-bulletins.htmlVendor Advisory
Timeline
- Published
- Dec 19, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed