CVE-2026-91798 Foxit CVE debrief

Who should care

Defenders and administrators responsible for managing Foxit PDF Editor and Reader installations, especially in environments where local user privilege escalation could have significant impacts, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-91798 is a local privilege escalation vulnerability in Foxit PDF Editor/Reader that allows regular users to modify the configuration file, potentially leading to arbitrary script execution with higher privileges. Defenders should prioritize verifying and remediating this vulnerability, especially in environments where local user privilege escalation could have significant impacts.

• Potential for local privilege escalation, allowing attackers to execute arbitrary scripts with higher privileges.
• Increased risk of lateral movement and exploitation within the network.
• Potential for data tampering and unauthorized access to sensitive information.
• Need for verification of Foxit PDF Editor and Reader versions and configurations to ensure security.

Technical summary

The vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration, allowing regular users to modify the configuration file and potentially leading to arbitrary script execution with higher privileges. This insecure configuration could allow attackers to execute scripts with elevated privileges, increasing the risk of lateral movement and exploitation within the network. Defenders should prioritize verifying and remediating this vulnerability in Foxit PDF Editor and Reader installations, especially in environments where local user privilege escalation could have significant impacts.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Foxit PDF Editor and Reader installations, especially in environments where local user privilege escalation could have significant impacts.

Recommended defensive actions

• Verify Foxit PDF Editor and Reader versions are up-to-date and not vulnerable.
• Implement secure configuration and permission settings for the update daemon.
• Monitor for suspicious activity related to local privilege escalation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.8 and the insecure permission configuration in the update daemon of Foxit PDF Editor/Reader. The vulnerability allows regular users to modify the configuration file, potentially leading to arbitrary script execution with higher privileges. Defenders should verify and remediate this vulnerability, especially in environments where local user privilege escalation could have significant impacts. Evidence is limited to CVE and NVD details; no 3

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.