CVE-2026-91813 PUBLISHED

Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability

Assigner: Foxit
Reserved: 15.09.2026 Published: 23.09.2026 Updated: 23.09.2026

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor Foxit Software Inc.
Product Foxit PDF Editor
Versions Default: unaffected
  • Version Versions 2026.2 and earlier is affected
  • Version Versions 14.0.7 and earlier is affected
  • Version Versions 13.2.6 and earlier is affected
Vendor Foxit Software Inc.
Product Foxit PDF Reader
Versions Default: unaffected
  • Version Versions 2026.2 and earlier is affected

Credits

  • praydog & kmx00 working with TrendAI Zero Day Initiative finder

References

Problem Types

  • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition CWE

Impacts

  • Local Privilege Escalation