Description

A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-23T08:17:12.363Z",
  "pubdate": "2026-09-23T08:17:12.363Z",
  "executiveSummary": "A local privilege escalation vulnerability has been identified in the Foxit PDF Editor and Reader updater component. The flaw stems from insecure dynamic-link library (DLL) loading practices during high-privilege operations, which allows a local attacker to execute arbitrary code with elevated system permissions.\nThe vulnerability type is classified as DLL search order hijacking. This issue poses a critical risk as it enables a low-privileged user to achieve full code execution under the context of the updater service, effectively granting administrative or system-level access to the compromised machine.\nExploitation requires local access to the affected system and the ability to write to specific directories where the updater application performs its search operations. By placing a malicious, identically named DLL in a location searched before the legitimate system library, an attacker can hijack the execution flow.\nThe impact includes total system compromise, unauthorized data access, and persistence mechanism deployment. The vulnerability is highly effective against systems where standard users can influence the filesystem structure within the application's search path, circumventing traditional boundary controls.",
  "technicalDetails": "The root cause of this vulnerability is improper handling of DLL loading during the execution of the Foxit PDF Editor/Reader updater process. When the updater initiates high-privilege operations, it attempts to load required dependencies without explicitly specifying the fully qualified path to the intended libraries. This reliance on default Windows search order creates a DLL hijacking vector.\nThe attack flow commences when the updater process is invoked, typically during an automated update check or when manually triggered under elevated permissions. Because the application searches for DLLs in several directories—including those that may be writable by a standard user—an attacker can place a malicious crafted DLL with a name identical to a legitimate dependency into such a directory.\nWhen the updater process calls functions to load these libraries, the operating system's loader searches the attacker-controlled directory before checking protected system directories (e.g., C:\\Windows\\System32). Upon locating the malicious DLL, the application loads it into the address space of the high-privilege process.\nOnce loaded, the exported functions within the malicious DLL are executed with the privileges of the updater process. This allows the attacker to execute arbitrary payloads, such as injecting shells, escalating local user privileges, or modifying system configurations. Since the updater operates with elevated rights, the malicious code bypasses user-mode restrictions and executes within a trusted context.\nThe vulnerability is facilitated by the search algorithm's behavior where the current directory or user-writable paths are prioritized or included in the lookup sequence. By successfully performing this hijacking, an attacker can achieve stable privilege escalation without triggering defensive alerts that might be associated with direct memory manipulation or exploit payloads, as the execution appears to originate from a signed, trusted application component.\nThis vulnerability is strictly a local exploitation vector. No network-based remote access is required to initiate the attack sequence, although an attacker who has already gained low-privileged remote access to the host can leverage this flaw to perform secondary escalation and persistence."
}