CVE-2026-91813

Analyzed Analyzed - Analysis Complete

Arbitrary Code Execution in Foxit PDF Editor/Reader via Update Mechanism

Publication date: 2026-09-23

Last updated on: 2026-10-08

Assigner: Foxit

Description

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-10-08

Generated

2026-10-13

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-91813

EUVD

EUVD-2026-85161

Affected Vendors & Products

Vendor	Product	Version / Range
foxit	pdf_editor	From 2023.1.0.15510 (inc) to 2023.3.0.23028 (inc)
foxit	pdf_editor	From 2024.1.0.23997 (inc) to 2024.4.1.27687 (inc)
foxit	pdf_editor	From 2025.1.0.27937 (inc) to 2025.3.0.35737 (inc)
foxit	pdf_editor	to 13.2.5.63482 (inc)
foxit	pdf_editor	From 14.0.0.33046 (inc) to 14.0.7.33751 (inc)
foxit	pdf_editor	From 2026.1.0.36452 (inc) to 2026.2.0.39747 (inc)
foxit	pdf_reader	to 2026.2.0.39747 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This vulnerability involves Foxit PDF Editor/Reader's update process. An attacker can replace an update package between download and extraction because the system does not properly lock files or validate their integrity. This allows malicious code to run with high privileges on the affected system.

Detection Guidance

This vulnerability involves tampering with update packages due to weak file locking and integrity checks. To detect it, monitor Foxit PDF Editor/Reader update processes for unexpected file modifications or privilege escalations during updates. Check for suspicious network activity during updates or files being locked improperly. No specific commands are provided in the context.

Impact Analysis

If exploited, this flaw could let attackers run arbitrary code on your computer with elevated privileges. This means they could install malware, steal data, or take full control of your system without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized code execution with elevated privileges, potentially compromising sensitive data. For GDPR, it may result in unauthorized access to personal data, violating confidentiality requirements. For HIPAA, it could expose protected health information, leading to compliance failures and legal penalties.

Mitigation Strategies

Disable automatic updates for Foxit PDF Editor/Reader until a patch is available. Monitor Foxit's official website for security advisories and apply updates manually once released. Restrict write permissions to Foxit's update directories to prevent unauthorized file replacement.

Hi! I’m here to help you understand CVE-2026-91813. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70