CVE-2025-9330: Foxit PDF Editor Privilege Escalation Flaw

CVE-2025-9330 Overview

CVE-2025-9330 is a local privilege escalation vulnerability in the Foxit PDF Reader Update Service. The flaw stems from an uncontrolled search path element [CWE-427] that causes the service to load a library from an unsecured location. A local attacker who can execute low-privileged code on the target system can leverage this weakness to execute arbitrary code in the context of SYSTEM. The issue was reported to Foxit through the Zero Day Initiative and tracked as ZDI-CAN-25709. Both Foxit PDF Reader and Foxit PDF Editor on Microsoft Windows are affected.

Critical Impact
Successful exploitation grants an attacker full SYSTEM-level code execution on Windows endpoints running vulnerable Foxit PDF products, enabling complete host compromise from a standard user account.

Affected Products

Foxit PDF Reader on Microsoft Windows
Foxit PDF Editor (including version 2025.1.0.27937 and earlier)
Foxit Reader Update Service component on Microsoft Windows

Discovery Timeline

2025-09-02 - CVE-2025-9330 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9330

Vulnerability Analysis

The vulnerability resides in the Foxit Reader Update Service, a Windows service that runs with SYSTEM privileges to check for and apply product updates. The service resolves and loads a dynamic-link library (DLL) from a directory that is not adequately protected against writes by lower-privileged users. An attacker with local access can place a malicious DLL in that search location. When the update service subsequently loads the library, the attacker-controlled code executes with SYSTEM authority.

This pattern is a classic uncontrolled search path element issue, categorized under CWE-427. Because the vulnerable process is a persistent service running elevated, the attacker does not need to trick an administrator into launching anything.

Root Cause

The root cause is improper qualification of the library search path used by the Foxit update service. The service does not restrict DLL resolution to a trusted, ACL-protected system directory, and the loading directory permits writes from non-privileged accounts. This combination allows a standard user to plant a DLL that will be loaded by a SYSTEM-level process.

Attack Vector

Exploitation requires local access and the ability to run low-privileged code, meaning the attacker must already have a foothold on the endpoint. The attacker writes a crafted DLL that matches the name and export signature the update service searches for, then waits for or triggers the service to load the module. Once loaded, the DLL's initialization code runs as SYSTEM, delivering full local privilege escalation. No user interaction is required. See the Zero Day Initiative Advisory ZDI-25-870 for additional technical detail.

No public proof-of-concept exploit or exploitation-in-the-wild activity is currently documented for CVE-2025-9330.

Detection Methods for CVE-2025-9330

Indicators of Compromise

Unexpected DLL files written to directories used by FoxitPDFReaderUpdateService.exe or related Foxit update binaries.
New or modified DLLs in the Foxit installation path with recent timestamps that do not correspond to a legitimate update event.
Child processes spawned by the Foxit update service running as NT AUTHORITY\SYSTEM that are not signed by Foxit.

Detection Strategies

Monitor DLL load events (Sysmon Event ID 7) for the Foxit update service loading unsigned or non-Foxit-signed modules.
Alert on file-creation events (Sysmon Event ID 11) targeting Foxit installation and update directories by non-installer, non-SYSTEM processes.
Correlate service restarts of the Foxit update service with preceding low-privileged write activity to its working directories.

Monitoring Recommendations

Baseline the legitimate DLL set loaded by the Foxit update service and flag deviations for review.
Track process ancestry where the parent is the Foxit update service and the child is an interpreter, shell, or LOLBIN.
Audit NTFS permissions on Foxit product directories on a recurring basis to detect drift toward user-writable ACLs.

How to Mitigate CVE-2025-9330

Immediate Actions Required

Update Foxit PDF Reader and Foxit PDF Editor to the fixed versions listed in the Foxit Security Bulletins.
Inventory Windows endpoints for installations of Foxit PDF Reader and Foxit PDF Editor and prioritize patching of multi-user and privileged systems.
Restrict interactive logon on hosts that process untrusted content with Foxit products to reduce local attacker opportunity.

Patch Information

Foxit has released updated versions of Foxit PDF Reader and Foxit PDF Editor that address CVE-2025-9330. Refer to the Foxit Security Bulletins and the Zero Day Initiative Advisory ZDI-25-870 for the specific fixed build numbers and release notes.

Workarounds

Tighten NTFS ACLs on the Foxit installation and update working directories to remove write permissions for non-privileged users.
Disable or stop the Foxit Reader Update Service until patches can be applied, and perform updates through a controlled software distribution process.
Apply application allowlisting (for example, Windows Defender Application Control or AppLocker) to block execution of unsigned DLLs from Foxit directories.

bash

# Configuration example: audit and harden Foxit update service directory permissions
# Inspect current ACL
icacls "C:\Program Files (x86)\Foxit Software\Foxit PDF Reader"

# Remove write/modify rights for standard users on the install directory
icacls "C:\Program Files (x86)\Foxit Software\Foxit PDF Reader" /remove:g "BUILTIN\Users"
icacls "C:\Program Files (x86)\Foxit Software\Foxit PDF Reader" /inheritance:r
icacls "C:\Program Files (x86)\Foxit Software\Foxit PDF Reader" /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F" "BUILTIN\Users:(OI)(CI)RX"

# Temporarily stop and disable the update service pending patch deployment
sc.exe stop "FoxitReaderUpdateService"
sc.exe config "FoxitReaderUpdateService" start= disabled