CVE-2026-57239 Overview
CVE-2026-57239 is a local privilege escalation vulnerability affecting Foxit PDF Editor and Foxit PDF Reader on Microsoft Windows. High-privilege processes belonging to the Foxit products directly execute user-controllable executable files without adequate validation. A low-privileged user who plants a malicious binary in a location referenced by these processes can obtain code execution as NT AUTHORITY\SYSTEM. The weakness is classified as [CWE-427] Uncontrolled Search Path Element. Successful exploitation requires local access and user interaction, but delivers full compromise of the host confidentiality, integrity, and availability guarantees.
Critical Impact
A local, low-privileged attacker can escalate to NT AUTHORITY\SYSTEM by placing a controllable executable where a Foxit high-privilege process will run it.
Affected Products
- Foxit PDF Editor on Microsoft Windows
- Foxit PDF Reader on Microsoft Windows
- Microsoft Windows host operating system
Discovery Timeline
- 2026-07-08 - CVE-2026-57239 published to the National Vulnerability Database
- 2026-07-09 - Last updated in the NVD database
Technical Details for CVE-2026-57239
Vulnerability Analysis
The flaw resides in how Foxit PDF Editor and Foxit PDF Reader launch helper executables from high-privilege processes. The privileged parent process resolves and executes a binary whose path or contents can be influenced by a standard user. When the privileged process invokes the binary, Windows inherits the elevated security token of the parent, granting the attacker's payload SYSTEM-level rights.
The issue maps to [CWE-427] Uncontrolled Search Path Element. This class of weakness typically arises when a service uses a writable directory, a relative path, or a per-user path when locating auxiliary executables. Foxit installs components that run under elevated contexts, including update and integration services, which broadens the attack surface for planting attacks.
Because the vector is local and requires user interaction, an attacker generally needs an existing foothold with interactive session rights. Once the payload runs as SYSTEM, the attacker can install persistence, disable endpoint controls, harvest credentials, and pivot laterally.
Root Cause
The root cause is trust placed by a privileged Foxit process in an executable whose location or content is writable by non-administrative accounts. The privileged process fails to verify the digital signature, canonical path, or ownership of the target binary before invocation, allowing a lower-privileged user to substitute an attacker-controlled executable.
Attack Vector
Exploitation is local. The attacker writes or replaces a binary in a directory searched by the privileged Foxit process, then triggers the workflow that causes the privileged process to launch the planted file. The planted process inherits SYSTEM privileges, granting complete host takeover.
No verified proof-of-concept code is publicly available. Refer to the Foxit Security Bulletins for vendor-supplied technical details.
Detection Methods for CVE-2026-57239
Indicators of Compromise
- Unexpected executables in Foxit installation, update, or per-user working directories with recent modification timestamps.
- Child processes spawned by Foxit update or integration services running as NT AUTHORITY\SYSTEM with non-Foxit-signed binaries.
- New scheduled tasks, services, or persistence entries created shortly after a Foxit-related process runs elevated.
Detection Strategies
- Alert on process creations where the parent is a Foxit signed binary and the child image is unsigned or resides in a user-writable path.
- Monitor file writes into directories consumed by Foxit privileged processes, correlating writes by standard users with subsequent privileged executions.
- Baseline the set of executables that Foxit high-privilege processes normally launch and flag deviations.
Monitoring Recommendations
- Enable Windows Sysmon Event ID 1 (process create) and Event ID 11 (file create) with rules covering Foxit directories.
- Forward endpoint telemetry to a centralized analytics platform to correlate low-privilege file writes with SYSTEM-level executions.
- Review Windows Security event logs for token elevations originating from Foxit-related process trees.
How to Mitigate CVE-2026-57239
Immediate Actions Required
- Apply the fixed Foxit PDF Editor and Foxit PDF Reader releases identified in the Foxit Security Bulletins.
- Restrict interactive logon on multi-user Windows hosts running Foxit products until patches are deployed.
- Audit ACLs on Foxit installation and update directories to ensure standard users cannot write to paths consumed by privileged processes.
Patch Information
Foxit has published remediation guidance on its security bulletins portal. Administrators should identify the affected build ranges for Foxit PDF Editor and Foxit PDF Reader and upgrade to the vendor-recommended fixed versions. See the Foxit Security Bulletins for the authoritative version matrix.
Workarounds
- Tighten NTFS permissions on Foxit program directories so that only administrators can write executable content.
- Disable or remove Foxit auto-update and helper services on endpoints that cannot be immediately patched.
- Apply application control policies such as Windows Defender Application Control or AppLocker to block execution of unsigned binaries from user-writable paths.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
