Skip to content
OpenAdvisories
High · 7.8 CVE-2026-3775 EUVD-2026-17751GHSA-j35c-qjxf-46vc

Foxit PDF Editor/Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Published Apr 1, 2026 · Updated Apr 2, 2026 · Assigned by Foxit

Description

The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these libraries may be resolved and loaded from user‑writable locations, a local attacker can place a malicious library there and have it loaded with SYSTEM privileges, resulting in local privilege escalation and arbitrary code execution.

Affected products

VendorProductAffectedFixed
Foxit Software Foxit PDF Editor Versions 2025.3 and earlier —
Foxit Software Foxit PDF Reader Versions 2025.3 and earlier —

Advisories 1

References