CVE-2026-91803

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Foxit PDF Editor/Reader

Publication date: 2026-09-23

Last updated on: 2026-10-08

Assigner: Foxit

Description

A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-10-08

Generated

2026-10-13

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-91803

EUVD

EUVD-2026-85166

Affected Vendors & Products

Vendor	Product	Version / Range
foxit	pdf_editor	From 2023.1.0.15510 (inc) to 2023.3.0.23028 (inc)
foxit	pdf_editor	From 2024.1.0.23997 (inc) to 2024.4.1.27687 (inc)
foxit	pdf_editor	From 2025.1.0.27937 (inc) to 2025.3.0.35737 (inc)
foxit	pdf_editor	to 13.2.5.63482 (inc)
foxit	pdf_editor	From 14.0.0.33046 (inc) to 14.0.7.33751 (inc)
foxit	pdf_editor	From 2026.1.0.36452 (inc) to 2026.2.0.39747 (inc)
foxit	pdf_reader	to 2026.2.0.39747 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-427	The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

Executive Summary

This is a local privilege escalation vulnerability in Foxit PDF Editor/Reader's updater. It occurs because the updater loads dynamic-link libraries from a user-writable directory during high-privilege operations. An attacker with local access could exploit this to run code with elevated privileges.

Detection Guidance

Detecting this vulnerability requires checking for unsafe DLL loading practices in Foxit PDF Editor/Reader's updater. Look for processes running with high privileges that load DLLs from user-writable directories. Use process monitoring tools like Process Monitor to observe DLL loading paths during updater operations.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain higher-level permissions on your system. This might let them install malicious software, access sensitive data, or perform other unauthorized actions with the privileges of a privileged user.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing local attackers to gain elevated privileges through unsafe library loading. Elevated privileges may lead to unauthorized access to sensitive data, which is a critical concern under both regulations.

Mitigation Strategies

Update Foxit PDF Editor/Reader to the latest version to patch the vulnerability. Ensure the updater no longer loads dynamic-link libraries from user-writable directories during high-privilege operations.

Hi! I’m here to help you understand CVE-2026-91803. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70