CVE-2026-91812 Overview
CVE-2026-91812 is a certificate validation vulnerability in the Foxit PDF Editor and Foxit PDF Reader update mechanism. The flaw allows adjacent-network attackers positioned as man-in-the-middle (MITM) to bypass Transport Layer Security (TLS) certificate validation and package integrity checks. Successful exploitation lets attackers deliver tampered update packages that execute arbitrary code with system privileges. The weakness maps to Improper Certificate Validation [CWE-295].
Critical Impact
An attacker on the same network segment can substitute a malicious update package and gain system-level code execution on the target host.
Affected Products
- Foxit PDF Editor
- Foxit PDF Reader
- Update client component responsible for retrieving and validating signed packages
Discovery Timeline
- 2026-09-23 - CVE-2026-91812 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-91812
Vulnerability Analysis
The Foxit PDF Editor and Reader update client fetches update metadata and installer packages from a remote endpoint. The client is expected to enforce strict TLS certificate validation and verify the cryptographic signature of the downloaded package before execution. According to the Foxit advisory, both checks can be bypassed under specific conditions.
An attacker with a network position between the client and the update service can intercept the update transaction. By supplying a substituted certificate or a modified package that the client accepts, the attacker delivers attacker-controlled code. Because the update runs with elevated rights, the resulting payload executes with system privileges. Exploitation requires user interaction, typically triggering or accepting an update prompt.
Root Cause
The root cause is improper certificate validation combined with insufficient enforcement of package integrity checks in the updater workflow. When validation fails to correctly compare the presented certificate chain against a trusted pin or root, or when signature verification is skipped for specific package fields, the client trusts adversary-supplied artifacts.
Attack Vector
The attack vector is adjacent network. An attacker on the same broadcast domain, a compromised Wi-Fi access point, or an upstream router can perform Address Resolution Protocol (ARP) spoofing, Domain Name System (DNS) poisoning, or transparent TLS interception to redirect update traffic. The attacker then serves a crafted package that the vulnerable updater accepts and installs.
No verified proof-of-concept code has been published. Refer to the Foxit Security Bulletin for authoritative technical detail.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-91812
Indicators of Compromise
- Unexpected Foxit updater processes writing executable files outside standard installation directories.
- Outbound update requests resolving to non-Foxit IP ranges or terminating at internal proxies not sanctioned by IT.
- Newly installed Foxit binaries lacking a valid Foxit code-signing signature.
- ARP or DNS anomalies preceding a Foxit update event on the same subnet.
Detection Strategies
- Monitor process creation events where FoxitPDFReaderUpdater.exe or FoxitPDFEditorUpdater.exe spawn child processes running unsigned or unexpected binaries.
- Alert on Foxit updater network connections that do not terminate at Foxit-owned infrastructure.
- Inspect Windows event logs for installer activity correlated with elevation to NT AUTHORITY\SYSTEM.
Monitoring Recommendations
- Enable TLS inspection logs on egress proxies to flag certificate anomalies for Foxit update domains.
- Track file-hash reputation for any binary dropped by the Foxit updater and compare against vendor-published hashes.
- Correlate endpoint update events with adjacent-network alerts such as rogue DHCP or ARP spoofing detections.
How to Mitigate CVE-2026-91812
Immediate Actions Required
- Apply the patched version of Foxit PDF Editor and Foxit PDF Reader as published in the Foxit Security Bulletin.
- Restrict automatic updates on untrusted networks such as public Wi-Fi until patched builds are deployed.
- Verify installed Foxit binaries carry valid vendor code signatures.
Patch Information
Foxit has published fixed versions through its security bulletin portal. Administrators should consult the Foxit Security Bulletin for the exact fixed release numbers and download packages from the official Foxit distribution channel only.
Workarounds
- Disable the in-application automatic update feature and distribute updates through a managed software deployment pipeline.
- Force update traffic through an inspected corporate egress path that enforces certificate pinning or allow-listing for Foxit domains.
- Segment endpoints from untrusted networks where adjacent-network MITM is feasible.
# Example: block Foxit updater outbound traffic and rely on managed deployment
# Windows Defender Firewall rule (run elevated)
netsh advfirewall firewall add rule name="Block Foxit Updater" \
dir=out program="C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReaderUpdater.exe" \
action=block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
