CVE-2026-91798: Foxit PDF Editor Privilege Escalation Flaw

CVE-2026-91798 Overview

CVE-2026-91798 is a local privilege escalation vulnerability in the update daemon of Foxit PDF Editor and Foxit PDF Reader. The flaw stems from an insecure permission configuration on the daemon's configuration file. Regular, unprivileged users can modify the configuration, which the update service later reads and acts upon. Because the daemon runs with higher privileges, an attacker can direct it to execute arbitrary scripts in a privileged context. The weakness is classified under [CWE-732: Incorrect Permission Assignment for Critical Resource].

Critical Impact
A local user with standard privileges can achieve arbitrary script execution at a higher privilege level, resulting in full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Foxit PDF Editor (update daemon component)
Foxit PDF Reader (update daemon component)
Refer to the Foxit Security Bulletins for the exact fixed versions

Discovery Timeline

2026-09-23 - CVE-2026-91798 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in the NVD database

Technical Details for CVE-2026-91798

Vulnerability Analysis

The Foxit update daemon relies on a configuration file to determine what updates to fetch and which scripts or executables to run during the update process. The daemon operates with elevated privileges so that it can install software system-wide. The configuration file, however, is installed with permissions that allow modification by non-administrative local users. This mismatch between the daemon's privilege level and the file's access control creates a privilege boundary violation. An attacker who can log in as a standard user can weaponize the daemon to run attacker-controlled logic as a higher-privileged account.

Root Cause

The root cause is an incorrect permission assignment on a critical resource ([CWE-732]). The update daemon's configuration file is writable by regular users, yet the daemon trusts its contents and executes referenced scripts without validating integrity or restricting the caller. Trust boundaries between the low-privileged file and the high-privileged consumer are not enforced.

Attack Vector

Exploitation requires local access and low privileges, with no user interaction. An attacker modifies the update daemon's configuration file to reference an attacker-controlled script or command. When the daemon next processes the configuration, typically during a scheduled or triggered update cycle, it executes the referenced payload with the daemon's elevated privileges. Because the vulnerability affects a scope-changing service, the resulting execution context exceeds the attacker's original permissions.

No verified public proof-of-concept code is currently referenced. Technical details are available in the Foxit Security Bulletins.

Detection Methods for CVE-2026-91798

Indicators of Compromise

Unexpected modifications to the Foxit update daemon configuration file by non-administrative user accounts.
Child processes spawned by the Foxit update service that do not match legitimate updater binaries or signed scripts.
Scripts or executables invoked from user-writable directories under the security context of the update daemon.
Newly created scheduled tasks, services, or persistence entries traceable to the update service process tree.

Detection Strategies

Monitor file integrity on the Foxit update daemon configuration file and alert on writes originating from standard user sessions.
Correlate process creation events where the parent is the Foxit update service and the child is a shell, script interpreter, or unsigned binary.
Baseline the update daemon's normal execution behavior and flag deviations such as command-line arguments referencing user directories.

Monitoring Recommendations

Enable process, file, and command-line telemetry on all endpoints running Foxit PDF Editor or Reader.
Review audit logs for permission changes on Foxit installation directories and configuration files.
Track service restarts and update cycles for the Foxit updater to identify anomalous execution windows.

How to Mitigate CVE-2026-91798

Immediate Actions Required

Inventory all endpoints running Foxit PDF Editor or Foxit PDF Reader and identify vulnerable versions.
Apply the vendor-supplied security update as soon as it is available from Foxit.
Restrict interactive local access on shared or multi-user systems until patches are deployed.
Audit the Foxit update daemon configuration file permissions and remove write access for non-administrative users.

Patch Information

Foxit publishes fixed builds and remediation guidance through the Foxit Security Bulletins. Administrators should consult the bulletin for CVE-2026-91798 to confirm the minimum patched version for each product line and deploy the update through their standard software distribution process.

Workarounds

Manually harden the access control list on the update daemon configuration file so that only administrators and the SYSTEM account can modify it.
Disable the automatic update service on affected hosts and manage Foxit updates through a controlled deployment mechanism until patched.
Apply application allowlisting to prevent the update daemon from executing unsigned or user-writable scripts.

bash

# Example: restrict write access on the Foxit update configuration file (Windows)
# Replace the path with the actual configuration file location from the vendor advisory
icacls "C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReaderUpdateService.cfg" /inheritance:r
icacls "C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReaderUpdateService.cfg" /grant:r "Administrators:(F)" "SYSTEM:(F)" "Users:(R)"