ZDI 2026-09-23

ZDI-26-741: Foxit PDF Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability

CVE-2026-91812

Machine-generated analysis · WAYSCloud LLM

A network-adjacent attacker can achieve arbitrary code execution by convincing a user to open a malicious file or visit a malicious page.

Context

Foxit PDF Reader is the affected product. The advisory reports an improper certificate validation issue in the FoxitUpdater component that enables local privilege escalation. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious web page.

Operator considerations

Check: Verify which systems have Foxit PDF Reader and the FoxitUpdater component installed.
Isolate: Limit network exposure of those systems until a mitigation is provided.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2026-91812.

Read the full advisory on ZDI →