ZDI discloses two Foxit PDF Reader FoxitUpdater privilege escalation vulnerabilities (CVE-2026-91812, CVE-2026-91813)

ZDI published two advisories on 2026-09-23 for Foxit PDF Reader's FoxitUpdater component: an improper certificate validation flaw (CVE-2026-91812, CVSS 7.1) exploitable by network-adjacent attackers and a race condition (CVE-2026-91813, CVSS 7.8) enabling…

ZDI issued two advisories on 2026-09-23 covering separate vulnerabilities in the FoxitUpdater component of Foxit PDF Reader. ZDI-26-741 tracks CVE-2026-91812, an improper certificate validation flaw rated CVSS 7.1; a network-adjacent attacker can execute arbitrary code, but the target must first visit a malicious page or open a malicious file, and the impact is described as local privilege escalation. ZDI-26-742 tracks CVE-2026-91813, a race condition rated CVSS 7.8 that allows a local attacker who can already run low-privileged code on the target to escalate privileges. Neither advisory reports that exploitation has been observed in the wild.

• ZDI-26-741 / CVE-2026-91812: improper certificate validation in Foxit PDF Reader's FoxitUpdater component, rated CVSS 7.1.
• CVE-2026-91812 requires user interaction — the target must visit a malicious page or open a malicious file — before a network-adjacent attacker can execute arbitrary code; impact is local privilege escalation.
• ZDI-26-742 / CVE-2026-91813: race condition in the FoxitUpdater component, rated CVSS 7.8, resulting in local privilege escalation.
• CVE-2026-91813 requires the attacker to already have the ability to run low-privileged code on the target system.
• Both ZDI advisories were published 2026-09-23T05:00:00Z; neither reports in-the-wild exploitation.