Local RCE in Foxit PDF Editor/Reader Update Mechanism 5.0+ (CVE-2026-91813)
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and extraction due to insufficient file locking and integrity validation. This flaw enables local attackers to execute arbitrary code with elevated privileges. The affected product is Foxit PDF Editor/Reader, with no specific version range provided in the data. The exploitation status is currently unknown, as no public exploit has been disclosed.
What to do: Upgrade to the latest version of Foxit PDF Editor/Reader to mitigate the flaw. Implement robust file locking and integrity validation mechanisms to prevent unauthorized updates. Regularly audit and monitor for potential exploitation risks.
| Foxit PDF Editor/Reader | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges.
FoxitUpdater race condition CVE-2026-91813 lets a local low-privileged attacker escalate privileges on Foxit PDF Reader.
ZDI-26-742 discloses a race condition in Foxit PDF Reader's FoxitUpdater that allows local privilege escalation. An attacker must already be able to run low-privileged code on the target. ZDI assigned CVSS 7.8 and CVE-2026-91813. No in-the-wild exploitation is reported.