Description

The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-23T08:17:11.570Z",
  "pubdate": "2026-09-23T08:17:11.570Z",
  "executiveSummary": "A critical vulnerability exists in Foxit PDF Editor and Reader related to insufficient permission verification within the application's secure reading mode. This flaw allows unauthorized, externally hosted SMB (Server Message Block) requests to be triggered automatically when a specially crafted PDF document is opened. The primary impact is the involuntary disclosure of NTLM (NT LAN Manager) credential hashes to a remote attacker-controlled SMB server. By intercepting these hashes, an attacker can conduct offline brute-force attacks or NTLM relay attacks to authenticate as the victim within a network environment. The vulnerability stems from the application's failure to adequately restrict or prompt the user before initiating external network resources during the document parsing process. Given that this exploit requires minimal user interaction—often merely opening a malicious file—it poses a significant risk to organizational environments where SMB authentication is prevalent. Attackers do not require elevated privileges to trigger this vulnerability, as it exploits the expected behavior of the operating system's WebClient service and the PDF engine's resource resolution logic.",
  "technicalDetails": "The vulnerability resides in the internal handling of embedded URI references within Foxit PDF Editor and Reader. When the PDF engine parses an object containing a resource reference (such as an icon, file attachment, or external link) that utilizes the UNC (Universal Naming Convention) path format (e.g., \\\\attacker-ip\\share\\file), the application attempts to resolve the path via the underlying operating system's SMB client. Specifically, the secure reading mode of Foxit PDF fails to validate the trust boundary of the resource request, allowing for non-interactive network authentication requests.\nThe attack flow commences when a victim opens a weaponized PDF file. Upon parsing, the PDF engine attempts to load an external resource from a remote UNC path. The Windows operating system, by design, attempts to establish a connection to the remote server to authenticate the user and retrieve the requested resource. During this handshake, the client sends a challenge-response NTLM hash to the remote host. An attacker, operating a listener (e.g., Responder, Inveigh, or a standard SMB server), captures the NetNTLMv2 hash of the user.\nThe root cause is a failure in permission enforcement where the application does not verify whether the destination host is a trusted or local network location before invoking network protocols. Because the application processes these requests silently, the user is never prompted with a security warning, effectively bypassing the expectation of 'secure reading mode'. This behavior is further exacerbated by the Windows WebClient service, which is often configured to automatically handle these requests.\nExploitation does not require authentication or elevated privileges; it is entirely client-side, triggered by the victim simply opening the file. The post-exploitation impact is severe, as the captured NTLM hash can be used to perform pass-the-hash attacks, NTLM relaying to other services (like SMB signing-disabled file shares or LDAP servers), or offline cracking to recover plaintext credentials. This facilitates lateral movement within a domain environment, enabling the attacker to escalate privileges or compromise further assets."
}