Description

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-23T08:17:13.550Z",
  "pubdate": "2026-09-23T08:17:13.550Z",
  "executiveSummary": "A critical vulnerability exists within the update mechanism of Foxit PDF Editor and Foxit PDF Reader, stemming from inadequate security controls during the file retrieval and extraction process. The flaw is classified as a Time-of-Check to Time-of-Use (TOCTOU) race condition exacerbated by insufficient cryptographic integrity validation.\nA local attacker can exploit this vulnerability to intercept and replace the legitimate update package after it has been downloaded but prior to its execution by the high-privilege update service. Successful exploitation results in local privilege escalation, allowing the attacker to execute arbitrary code with elevated system permissions.\nThe vulnerability poses significant risk, as it allows for persistent system compromise and full control over the application's execution environment. Exploitation requires local access to the target machine and the ability to manipulate the file system environment where the update package is staged. Because the update service operates with elevated privileges, the malicious payload inherits these privileges, bypassing standard user-level security boundaries.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of temporary update files within the Foxit PDF Editor/Reader update workflow. The application downloads update packages to a predictable local file system location. However, the update mechanism fails to implement exclusive file locking or atomic operations to protect these staging files from unauthorized modification after the download is complete but before the extraction process commences.\nThe attack flow proceeds as follows: First, the attacker monitors the local file system for the initiation of the Foxit update process. Second, once the application triggers a download of an update package, the attacker observes the creation of the temporary package file. Third, due to the lack of sufficient file access control lists (ACLs) or file locking mechanisms, the attacker performs a race condition exploitation. The attacker overwrites the legitimate, signed-but-unverified (or inadequately verified) update package with a malicious payload during the small temporal window between the download finish signal and the invocation of the extraction routine.\nThe vulnerability is further compounded by a lack of rigorous integrity validation. If the update mechanism does not perform a strict cryptographic hash comparison or digital signature verification against a secure, immutable reference prior to passing the file to the high-privilege extraction process, the application inadvertently processes the attacker-supplied malicious archive.\nSince the update service operates with high-privilege (typically SYSTEM or Administrator level) to facilitate system-wide application updates, the extraction process executes the attacker's payload within that privileged context. This allows for the arbitrary execution of code, which can be leveraged to establish persistence, inject malicious libraries into the host process, or gain complete control over the affected system. The lack of process-specific sandboxing for the update agent allows the malicious payload to perform unauthorized operations, including system modification or data exfiltration, without triggering standard user-mode prompts or security warnings."
}