CVE-2026-91803: Foxit PDF Editor/Reader Privilege Escalation

CVE-2026-91803 Overview

CVE-2026-91803 is a local privilege escalation vulnerability in the updater component of Foxit PDF Editor and Foxit PDF Reader. The updater loads dynamic-link libraries (DLLs) from a user-writable directory during high-privilege operations. A local attacker with low privileges can plant a malicious DLL that the updater loads and executes in an elevated security context. The weakness is classified as [CWE-427] Uncontrolled Search Path Element. Successful exploitation grants the attacker code execution with elevated privileges on the affected host, breaking the boundary between a standard user and privileged system components.

Critical Impact
A local, low-privileged attacker can achieve code execution with elevated privileges by placing a malicious DLL in a directory searched by the Foxit updater during a privileged update operation.

Affected Products

Foxit PDF Editor (Windows)
Foxit PDF Reader (Windows)
Foxit updater component bundled with the above products

Discovery Timeline

2026-09-23 - CVE-2026-91803 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91803

Vulnerability Analysis

The Foxit updater executes with higher privileges than the invoking user to install product updates. During these privileged operations, the updater resolves and loads one or more DLLs using a search path that includes a directory writable by standard users. Because Windows follows the DLL search order, any attacker-controlled DLL that matches an expected name is loaded before the legitimate library. The loaded DLL runs inside the privileged updater process, giving the attacker execution rights outside the original user context. The scope-changed impact reflects that a low-privileged local account can influence a higher-privileged process.

Root Cause

The root cause is unsafe DLL loading behavior in the updater [CWE-427]. The process does not restrict the load path to a trusted, non-writable location and does not validate the origin or signature of the DLL before mapping it into memory. Any user able to write to the search-path directory can substitute their own module.

Attack Vector

Exploitation requires local access and low privileges. The attacker places a crafted DLL with a name expected by the updater into the user-writable directory that appears earlier in the resolver's search order. When the updater runs, either automatically or when triggered, the malicious DLL is loaded and its DllMain executes with the updater's elevated token. See the Foxit Security Bulletins for vendor-supplied technical details.

// No verified proof-of-concept code has been published for CVE-2026-91803.
// Refer to the Foxit Security Bulletins for authoritative technical details.

Detection Methods for CVE-2026-91803

Indicators of Compromise

Unsigned or unexpected DLL files present in directories used by the Foxit updater, particularly user-writable paths under the user profile or product installation staging folders.
Foxit updater processes loading modules from paths outside the standard Program Files installation directory.
New executable files created in updater working directories by non-administrative user accounts shortly before an updater run.

Detection Strategies

Monitor image-load events (Windows Sysmon Event ID 7) for Foxit updater processes and alert when loaded DLL paths fall outside trusted, signed locations.
Correlate process creation of the Foxit updater with recent file writes to its DLL search directories by non-SYSTEM accounts.
Alert on child processes spawned by the Foxit updater that are inconsistent with normal update activity, such as command shells or scripting hosts.

Monitoring Recommendations

Enable Sysmon with a configuration that logs ImageLoad, ProcessCreate, and FileCreate events for Foxit binaries.
Track integrity levels of processes descending from the updater to identify privilege transitions.
Baseline expected DLL loads for the updater and treat deviations as high-priority alerts.

How to Mitigate CVE-2026-91803

Immediate Actions Required

Apply the vendor-provided patch for Foxit PDF Editor and Foxit PDF Reader as soon as it is available from the Foxit Security Bulletins.
Restrict write permissions on any user-writable directories referenced by the Foxit updater search path.
Remove or disable the Foxit updater component on systems where it is not required until patching is complete.

Patch Information

Foxit publishes fixed versions through its security advisory portal. Review the Foxit Security Bulletins for the specific patched versions of Foxit PDF Editor and Foxit PDF Reader that address CVE-2026-91803, and deploy them across all Windows endpoints running the affected software.

Workarounds

Enforce application allowlisting to permit only signed, vendor-issued DLLs to load into the Foxit updater process.
Remove standard-user write access from the directories the updater searches during privileged operations.
Prevent unattended execution of the updater by disabling scheduled tasks or auto-update triggers until the patch is applied.

bash

# Example: audit ACLs on a suspected user-writable updater directory (Windows PowerShell)
Get-Acl 'C:\Path\To\FoxitUpdater' | Format-List
# Remove write access for standard users
icacls 'C:\Path\To\FoxitUpdater' /remove:g 'BUILTIN\Users'