Description

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-23T08:17:11.793Z",
  "pubdate": "2026-09-23T08:17:11.793Z",
  "executiveSummary": "A local privilege escalation vulnerability exists within the update daemon component of Foxit PDF Editor and Foxit PDF Reader.\nThe vulnerability stems from an insecure permission configuration applied to the application's configuration file, which permits unauthorized write access by unprivileged local users.\nBy modifying this configuration file, a local attacker can manipulate the update process to achieve arbitrary script execution with elevated privileges, typically running under the context of the SYSTEM or root user.\nThis flaw presents a significant security risk, as it allows standard users to bypass system-imposed access controls and escalate their privileges to those of a highly privileged service account.\nExploitation requires local access to the affected system; however, it does not require prior administrative privileges. The vulnerability fundamentally undermines the integrity of the update mechanism, enabling the execution of arbitrary code during the service's operation. No complex network interaction is required, making this a target for malicious actors attempting to gain full control over a compromised workstation.",
  "technicalDetails": "The vulnerability is localized within the Foxit update daemon, a background process responsible for polling and installing application updates. The security flaw is categorized as an improper access control issue, specifically relating to the file system permissions assigned to the daemon's configuration settings.\nThe root cause of the vulnerability is the assignment of permissive access control lists (ACLs) to the daemon's configuration file. Because the file is writable by the 'Users' group rather than being restricted to the 'Administrators' or 'SYSTEM' accounts, any local user can modify the contents of this file.\nThe exploitation flow begins with the attacker identifying the path to the update configuration file. Once identified, the attacker modifies parameters within the configuration file—such as the update source URL, path to executable update packages, or command-line arguments used during the installation process—to point towards a malicious script or binary controlled by the attacker.\nWhen the update daemon initiates its periodic check or is triggered to execute an update, it reads the tampered configuration file. Due to the daemon's elevated service-level privileges, it executes the specified malicious payload as if it were a legitimate update component. This process effectively elevates the attacker's code execution from a standard user session to the security context of the update service.\nBecause the update daemon operates with SYSTEM-level or administrative privileges to ensure successful installation of software updates, any arbitrary script executed through this mechanism inherits the same high-level system permissions. This allows the attacker to perform unrestricted actions on the operating system, including installing persistent backdoors, dumping credentials, modifying protected system files, or disabling security software.\nThe vulnerability does not involve remote network exposure; it is restricted to local exploitation. The attack surface is defined by the ability of any authenticated local user to interact with the file system path where the configuration is stored. Authentication to the host is a prerequisite, as the attacker must be capable of executing commands or performing file operations within the local file system to modify the target configuration."
}