CVE-2025-13941 Overview
CVE-2025-13941 is a local privilege escalation vulnerability in the Foxit PDF Reader and Foxit PDF Editor Update Service on Windows. The update service assigns incorrect file system permissions to plugin installation resources. A local attacker with low privileges can modify or replace those resources. The update service later executes the tampered resources with SYSTEM privileges, granting the attacker full control of the host. The flaw is tracked under [CWE-732: Incorrect Permission Assignment for Critical Resource].
Critical Impact
A standard user account can escalate to SYSTEM on any Windows host running a vulnerable Foxit PDF Reader or Editor installation, bypassing endpoint security boundaries.
Affected Products
- Foxit PDF Editor on Microsoft Windows
- Foxit PDF Reader on Microsoft Windows
- Foxit Update Service component (plugin installation flow)
Discovery Timeline
- 2025-12-19 - CVE-2025-13941 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13941
Vulnerability Analysis
The Foxit PDF Reader/Editor Update Service runs as a privileged Windows service and is responsible for installing product plugins. During plugin installation, the service writes resources to disk with permissive Access Control Lists (ACLs) that grant write access to low-privileged local users. Those same resources are later invoked by the SYSTEM-level update service, creating a classic privilege boundary crossing.
An attacker who authenticates locally to the target host can substitute an attacker-controlled binary or supporting file for one of these resources. When the update service subsequently runs, it loads or executes the attacker's payload under the NT AUTHORITY\SYSTEM security context. This yields arbitrary code execution at the highest local integrity level and enables lateral movement, credential theft, and persistence.
Root Cause
The root cause is improper permission assignment on resources controlled by a high-privileged service. The plugin installer applies ACLs that do not restrict write access to administrators or the SYSTEM account. Any authenticated user on the machine can therefore modify files that the SYSTEM service will later trust and execute.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. The scope changes because a low-privileged user gains SYSTEM-level control, impacting resources outside the original security scope. The attacker overwrites or replaces the writable resource, then waits for or triggers the update service to execute it. Technical specifics are described in the Foxit Security Bulletins.
Detection Methods for CVE-2025-13941
Indicators of Compromise
- Unexpected file writes by non-administrative users into Foxit installation or update service directories.
- New or modified executables, DLLs, or scripts within Foxit plugin folders that are not signed by Foxit.
- Child processes spawned by the Foxit update service running under NT AUTHORITY\SYSTEM that do not match legitimate updater binaries.
Detection Strategies
- Audit ACLs on Foxit PDF Reader/Editor installation and plugin directories and flag any entry granting write access to Users, Authenticated Users, or Everyone.
- Correlate process creation events (Windows Event ID 4688 / Sysmon Event ID 1) where the parent process is the Foxit update service and the child process is not a known Foxit binary.
- Hunt for file modification events (Sysmon Event ID 11) in Foxit paths performed by non-administrative Security Identifiers (SIDs).
Monitoring Recommendations
- Enable command-line auditing and Sysmon on endpoints with Foxit PDF Reader or Editor installed.
- Alert on service-launched processes executing from user-writable directories.
- Track version inventory for Foxit PDF Reader and Editor to prioritize patch verification across the fleet.
How to Mitigate CVE-2025-13941
Immediate Actions Required
- Update Foxit PDF Reader and Foxit PDF Editor to the fixed release listed in the Foxit Security Bulletins.
- Inventory all Windows endpoints running Foxit products and prioritize multi-user systems, jump hosts, and shared workstations.
- Restrict local logon rights on sensitive hosts to reduce the population of accounts that can trigger the flaw.
Patch Information
Foxit has published fixed versions of Foxit PDF Reader and Foxit PDF Editor that correct the plugin installation permission assignment. Refer to the vendor's Foxit Security Bulletins for the specific fixed build numbers and download links. Apply the patch through your standard software distribution tooling and verify that the update service files no longer grant write access to non-administrative users.
Workarounds
- If patching cannot be performed immediately, manually harden ACLs on the Foxit update service and plugin directories to remove write permissions for Users and Authenticated Users.
- Disable the Foxit update service on hosts where automatic updates are not required and manage updates centrally.
- Consider temporarily uninstalling Foxit PDF Reader and Editor on multi-tenant systems until the patched version is deployed.
# Example: audit ACLs on the Foxit update service directory (run in elevated PowerShell)
Get-Acl "C:\Program Files (x86)\Foxit Software\Foxit PDF Reader" | Format-List
Get-Acl "C:\Program Files (x86)\Foxit Software\Foxit PDF Editor" | Format-List
# Remove write access for the local Users group if present
icacls "C:\Program Files (x86)\Foxit Software\Foxit PDF Reader" /remove:g "BUILTIN\Users" /T
icacls "C:\Program Files (x86)\Foxit Software\Foxit PDF Editor" /remove:g "BUILTIN\Users" /T
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
