CVE-2026-91800: Foxit PDF Editor Privilege Escalation Flaw

CVE-2026-91800 Overview

CVE-2026-91800 is a local privilege escalation vulnerability in the Foxit PDF Editor installer for macOS. The installer fails to properly validate a user-modifiable configuration value during high-privilege upgrade operations. A local attacker with limited privileges can manipulate this value to execute arbitrary commands as root. The weakness is classified under [CWE-732] (Incorrect Permission Assignment for Critical Resource).

Critical Impact
A local, authenticated attacker can escalate from a standard user account to root, gaining full control of the affected macOS system during Foxit PDF Editor upgrade operations.

Affected Products

Foxit PDF Editor for macOS (installer component)
Refer to the Foxit Security Bulletins for exact affected versions
Systems where a low-privileged user can trigger or influence the upgrade workflow

Discovery Timeline

2026-09-23 - CVE-2026-91800 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91800

Vulnerability Analysis

The vulnerability resides in the Foxit PDF Editor for macOS installer logic that runs with elevated privileges during upgrade operations. During these upgrades, the installer reads a configuration value that a local, unprivileged user can modify. The installer trusts this value without sufficient validation and uses it in a privileged execution path.

Because the elevated installer component acts on attacker-controlled input, a local user can influence which command or binary the privileged process executes. The result is arbitrary command execution in the security context of root, breaking the boundary between standard user and system administrator on macOS.

This pattern maps to [CWE-732], where a critical resource, in this case the configuration value consumed by a privileged installer, is assigned permissions that allow untrusted modification. The flaw is not exploitable remotely and requires an existing foothold on the target host.

Root Cause

The root cause is insufficient validation of a user-modifiable configuration value inside a high-privilege upgrade path. The privileged installer should treat any input reachable by a non-root user as untrusted and validate it against a strict allowlist before use. Instead, the value is consumed directly, enabling injection into a privileged execution flow.

Attack Vector

Exploitation requires local access and low-privileged authentication on the macOS host. The attacker modifies the configuration value that the installer will later consume, then triggers or waits for a Foxit PDF Editor upgrade to run with elevated privileges. When the installer processes the tainted value, the attacker-supplied command runs as root. No user interaction from an administrator is required beyond the normal upgrade flow.

See the Foxit Security Bulletins for vendor-provided technical detail on the affected component and fixed versions.

Detection Methods for CVE-2026-91800

Indicators of Compromise

Unexpected child processes spawned by the Foxit installer or updater running as root.
Modifications to Foxit installer configuration files by non-administrative user accounts.
New or altered files under Foxit application or support directories immediately before an upgrade event.
Shell interpreters (/bin/sh, /bin/bash, /bin/zsh) launched as children of the Foxit updater process.

Detection Strategies

Monitor process ancestry on macOS endpoints for privileged installer processes that launch shells or arbitrary binaries.
Alert on writes to Foxit configuration paths performed by non-root, non-installer processes.
Correlate Foxit upgrade events with subsequent privilege transitions to uid=0 originating from a standard user session.

Monitoring Recommendations

Enable macOS Endpoint Security telemetry for process execution, file modification, and privilege elevation events on systems running Foxit PDF Editor.
Retain installer and updater logs centrally so that upgrade sequences can be reconstructed during investigation.
Baseline normal Foxit updater behavior and alert on deviations such as unexpected command-line arguments or child processes.

How to Mitigate CVE-2026-91800

Immediate Actions Required

Inventory macOS endpoints running Foxit PDF Editor and identify hosts with multi-user access.
Upgrade Foxit PDF Editor for macOS to the fixed version listed in the vendor advisory as soon as it is available.
Restrict local interactive access on shared macOS systems to trusted users until patches are deployed.
Audit permissions on Foxit installer and configuration directories to confirm they are not writable by standard users.

Patch Information

Foxit addresses this vulnerability in an updated release of Foxit PDF Editor for macOS. Consult the Foxit Security Bulletins page for the exact fixed version and download links. Apply the vendor-supplied update through a controlled deployment channel and verify the installed version after upgrade.

Workarounds

Defer or block user-initiated upgrades of Foxit PDF Editor until administrators can apply the patched version.
Remove Foxit PDF Editor from systems where a suitable alternative PDF tool is acceptable, pending remediation.
Enforce file system permissions so that only administrative accounts can modify Foxit installer configuration values.
Limit membership in local user groups on shared macOS hosts to reduce the population of potential local attackers.

bash

# Configuration example: verify installed Foxit PDF Editor version on macOS
/usr/bin/mdls -name kMDItemVersion "/Applications/Foxit PDF Editor.app"

# Review ownership and permissions on Foxit application and support directories
/bin/ls -laO "/Applications/Foxit PDF Editor.app"
/bin/ls -laO "/Library/Application Support/Foxit Software" 2>/dev/null

# Identify non-root writers to Foxit paths in unified logs (adjust predicate as needed)
/usr/bin/log show --predicate 'subsystem CONTAINS "com.foxitsoftware"' --last 7d