8.8Alta
CVE-2026-91803Security Vulnerability Report – Foxit PDF Editor/Reader Updater DLL Search Path Hijacking
Descripción
A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges.
Debilidad (CWE):
CWE-427
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Foxit Software Inc. | Foxit PDF Editor | Versions 2026.2 and earlier, Versions 14.0.7 and earlier | |
| Foxit Software Inc. | Foxit PDF Reader | Versions 2026.2 and earlier | |
| foxit | pdf editor | ≤ 13.2.5.63482 | |
| foxit | pdf reader | ≤ 2026.2.0.39747 |
Referencias y parches
- https://www.foxit.com/support/security-bulletins.html Vendor Advisory
Coincidencias CPE (NVD) (7)
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≤ 13.2.5.63482cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 14.0.0.33046 ≤ 14.0.7.33751cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2023.1.0.15510 ≤ 2023.3.0.23028cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2024.1.0.23997 ≤ 2024.4.1.27687cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2025.1.0.27937 ≤ 2025.3.0.35737cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2026.1.0.36452 ≤ 2026.2.0.39747cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*≤ 2026.2.0.39747