ZDI-26-741: Foxit PDF Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability
ZDI disclosed a FoxitUpdater certificate flaw that lets network-adjacent attackers run code after a user opens a malicious file.
ZDI-26-741 covers improper certificate validation in the FoxitUpdater component of Foxit PDF Reader, tracked as CVE-2026-91812. Network-adjacent attackers can execute arbitrary code, but the target must visit a malicious page or open a malicious file. ZDI assigned CVSS 7.1 and describes the impact as local privilege escalation. The advisory does not state that exploitation has been observed.
- CVE-2026-91812 is improper certificate validation in FoxitUpdater.
- Network-adjacent attackers can execute arbitrary code after user interaction.
- ZDI rated the issue CVSS 7.1; exploitation is not reported as observed.
- CVEs
- CVE-2026-91812
- Vendors
- Foxit
- Products
- Foxit PDF ReaderFoxitUpdater
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91812 | CVE-2026-91812 RCE in Foxit PDF Editor/Reader Update Mechanism | 8.1 | — |
From the original article
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.