CVE-2026-91813 Overview
CVE-2026-91813 is a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-367] in the update mechanism of Foxit PDF Editor and Foxit PDF Reader. The updater downloads an installation package but fails to enforce sufficient file locking and integrity validation before a high-privilege process extracts and executes it. A local attacker with low privileges can replace the update package between the download and extraction stages. Successful exploitation leads to arbitrary code execution in an elevated security context, with scope change extending impact beyond the vulnerable component.
Critical Impact
Local low-privileged users can substitute Foxit update packages during the update workflow to achieve arbitrary code execution with elevated privileges.
Affected Products
- Foxit PDF Editor (update mechanism)
- Foxit PDF Reader (update mechanism)
- Refer to the Foxit Security Bulletins for exact affected versions
Discovery Timeline
- 2026-09-23 - CVE-2026-91813 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-91813
Vulnerability Analysis
The flaw resides in the sequence of operations executed by the Foxit updater. The updater retrieves an installer package to a location writable or influenceable by a local low-privileged user. A separate high-privilege service later reads, extracts, and executes the package contents. Between these two operations, the updater neither maintains an exclusive lock on the file nor re-validates its cryptographic integrity immediately before execution. This gap defines the classic TOCTOU condition described in [CWE-367]. The CVSS scope change reflects that the compromised update service impacts system components beyond its own security boundary, producing full loss of confidentiality, integrity, and availability on the host.
Root Cause
The root cause is the absence of atomic handling between validation and use of the update payload. The updater checks the file at one moment and consumes it at a later moment without preserving a trusted handle or re-verifying the signature and hash immediately before extraction. Insufficient file locking allows the underlying file to be swapped, truncated, or overwritten during the window.
Attack Vector
A local attacker with an authenticated low-privileged session monitors the updater workflow. When the update package lands on disk, the attacker replaces it with a malicious package before the privileged extraction process consumes the file. The privileged service then extracts and executes attacker-controlled content, yielding code execution at elevated privileges. Because exploitation depends on winning a timing race, an attacker typically uses filesystem notifications or polling to trigger the swap at the correct instant.
No public proof-of-concept code has been published. Refer to the Foxit Security Bulletins for vendor technical details.
Detection Methods for CVE-2026-91813
Indicators of Compromise
- Unexpected file replacement, rename, or handle events targeting Foxit update staging directories shortly before the updater executes an installer.
- Foxit updater processes spawning non-Foxit signed child processes or executing binaries whose Authenticode signature does not chain to Foxit Software.
- New services, scheduled tasks, or persistence artifacts created immediately following a Foxit update event.
Detection Strategies
- Monitor filesystem activity in the Foxit update staging path for write, rename, or delete operations originating from non-Foxit processes.
- Alert on privilege elevation chains where a Foxit updater component launches an unsigned or non-Foxit signed executable.
- Correlate rapid open/close/rename sequences on .exe, .msi, or .zip files within update directories to surface race-condition exploitation attempts.
Monitoring Recommendations
- Enable process creation, file integrity, and signature verification telemetry on endpoints running Foxit PDF Editor or Reader.
- Baseline normal Foxit update behavior and alert on deviations such as unusual parent-child process relationships or unsigned child binaries.
- Retain endpoint telemetry long enough to reconstruct pre-update filesystem activity when investigating suspected privilege escalation.
How to Mitigate CVE-2026-91813
Immediate Actions Required
- Upgrade Foxit PDF Editor and Foxit PDF Reader to the fixed versions listed in the Foxit Security Bulletins.
- Inventory endpoints running Foxit software and prioritize multi-user systems, jump hosts, and shared workstations where local access is broader.
- Restrict interactive local logon rights on systems where Foxit updates run with elevated privileges.
Patch Information
Foxit publishes fixed builds and remediation guidance through its security bulletins portal. Administrators should consult the Foxit Security Bulletins to identify the specific fixed versions for CVE-2026-91813 and deploy them across all affected endpoints.
Workarounds
- Disable the automatic updater and deploy Foxit updates through a managed software distribution channel that validates package integrity before execution.
- Tighten access control lists on the Foxit update staging directory so only the elevated service account can write to it.
- Enforce application control policies that permit only Foxit-signed binaries to execute from Foxit installation and update paths.
# Example: restrict write access on Windows update staging directory
icacls "C:\ProgramData\Foxit Software\Addon\Updater" /inheritance:r
icacls "C:\ProgramData\Foxit Software\Addon\Updater" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "C:\ProgramData\Foxit Software\Addon\Updater" /remove "Users" "Authenticated Users"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
