CVE-2025-13941

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions are assigned to resources used by the update service. A local attacker with low privileges could modify or replace these resources, which are later executed by the service, resulting in execution of arbitrary code with SYSTEM privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Dec 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-139429.8A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remo CVE-2025-139438.8A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.5 CVE-2025-139455.5HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service CVE-2025-139465.5MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service CVE-2025-139477.4A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is p CVE-2025-139485.6A vulnerability was determined in opsre go-ldap-admin up to 20251011. This issue affects some unknown processing of the file docs/docker-com CVE-2025-139496.3A vulnerability was identified in ProudMuBai GoFilm 1.0.0/1.0.1. Impacted is the function SingleUpload of the file /server/controller/FileCo CVE-2025-13958.2Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson a CVE-2025-139505.3The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c CVE-2025-139529.8A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free c CVE-2025-139539.3Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) logi CVE-2025-139549.3Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and ga