ZDI-26-741: Foxit PDF Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability
ZDI disclosed a FoxitUpdater certificate flaw that lets network-adjacent attackers run code after a user opens a malicious file.
48
CVE-2026-91812
CVE-2026-91812 RCE in Foxit PDF Editor/Reader Update Mechanism
- CVSS 3.1
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, enabling arbitrary code execution with system privileges. The flaw is triggered through the update mechanism, and an attacker can achieve arbitrary code execution with system privileges. Affected products are Foxit PDF Editor/Reader. Exploitation status is currently in the wild, with no publicly known exploit.
What to do: Upgrade to the latest Foxit PDF Editor/Reader; enable certificate validation and integrity checks; monitor for CVE-2026-91812 and related advisories; verify deployment and configuration to prevent MTI and privilege escalation.
| Product | Affected |
|---|---|
| Foxit PDF Editor/Reader | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges.
- Vendors
- foxit
- Products
- pdf editor, pdf reader
- Weakness
- CWE-295
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H