Foxit PDF Reader Vulnerability (CVE-2026-57239) Enables SYSTEM-Level Privilege Escalation
A critical local privilege escalation flaw in Foxit PDF Reader, tracked as CVE-2026-57239, allows standard Windows users to gain SYSTEM-level control under specific conditions. The vulnerability, discovered through research into Foxit’s updater and service architecture, serves as a high-impact post-exploitation pathway but requires prior code execution on the target system.
The flaw stems from insecure interactions between Foxit’s updater component and a privileged Windows service running as NT AUTHORITY\SYSTEM. Researchers found that the updater executable located in the user’s AppData directory attempted to load libraries, including winspool.drv, without proper validation. Attackers could exploit this by placing a malicious proxy file, enabling code execution within the updater’s context.
To escalate privileges, the exploit chains this behavior with FoxitPDFReaderUpdateService.exe, a service that monitors FoxitData.txt in the ProgramData directory a file writable by low-privileged users. By manipulating this file, attackers could influence the service to launch the updater with SYSTEM privileges. The service expects encrypted instructions in FoxitData.txt, protected by a hardcoded AES-128-CBC key embedded in the binary. Once decrypted, crafted payloads could trigger the updater’s execution under elevated privileges.
Despite built-in safeguards like certificate validation, attackers bypassed restrictions by combining the privileged execution flow with DLL sideloading. A malicious driver file placed alongside the updater executable would load when the service launched the updater, granting SYSTEM-level code execution. Researcher Luke Paris later identified an alternative exploitation path involving GUI interaction, where forcing the updater to display a prompt and triggering specific actions re-enabled module loading, even after initial patches.
Successful exploitation provides full system control, including arbitrary command execution, security control manipulation, and persistence. Due to its local access requirement, the vulnerability is most relevant in targeted attacks, post-compromise scenarios, or chained exploits.
Detection methods include monitoring for unauthorized modifications to FoxitData.txt, unusual process execution from AppData Foxit directories, and unexpected .dll or .drv files in user-controlled paths. Security teams should also review Windows event logs for token manipulation and anomalous service-driven process launches.
Foxit addressed the issue in version 2026.2, with additional mitigation strategies including AppLocker policies to restrict unauthorized module loading and monitoring of writable directories used by privileged services. The vulnerability underscores risks tied to improper validation of inter-process communication and library loading, highlighting the need for strict boundary enforcement between user inputs and SYSTEM-level services.
Source: https://cybersecuritynews.com/foxit-updater-vulnerability/
Foxit cybersecurity rating report: https://www.rankiteo.com/company/foxit-corporation
"id": "FOX1784953419",
"linkid": "foxit-corporation",
"type": "Vulnerability",
"date": "6/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Technology/Software',
'name': 'Foxit PDF Reader',
'type': 'Software'}],
'attack_vector': 'Local',
'description': 'A critical local privilege escalation flaw in Foxit PDF '
'Reader, tracked as CVE-2026-57239, allows standard Windows '
'users to gain SYSTEM-level control under specific conditions. '
'The vulnerability stems from insecure interactions between '
'Foxit’s updater component and a privileged Windows service '
'running as NT AUTHORITY\\SYSTEM. Exploitation requires prior '
'code execution on the target system and involves DLL '
'sideloading and manipulation of FoxitData.txt to achieve '
'SYSTEM-level code execution.',
'impact': {'operational_impact': 'Full system control, arbitrary command '
'execution, security control manipulation, '
'and persistence',
'systems_affected': 'Windows systems with Foxit PDF Reader '
'installed'},
'lessons_learned': 'The vulnerability underscores risks tied to improper '
'validation of inter-process communication and library '
'loading, highlighting the need for strict boundary '
'enforcement between user inputs and SYSTEM-level '
'services.',
'post_incident_analysis': {'corrective_actions': 'Patch released in version '
'2026.2, implementation of '
'AppLocker policies, and '
'enhanced monitoring of '
'privileged service '
'directories.',
'root_causes': 'Insecure interactions between '
'Foxit’s updater component and a '
'privileged Windows service, '
'improper validation of library '
'loading, and manipulation of '
'FoxitData.txt with a hardcoded '
'AES-128-CBC key.'},
'recommendations': ['Update Foxit PDF Reader to version 2026.2 or later.',
'Implement AppLocker policies to restrict unauthorized '
'module loading.',
'Monitor writable directories used by privileged services '
'for unauthorized modifications.',
'Review Windows event logs for token manipulation and '
'anomalous service-driven process launches.'],
'references': [{'source': 'Research by Luke Paris'}],
'response': {'enhanced_monitoring': 'Monitoring for unauthorized '
'modifications to FoxitData.txt, unusual '
'process execution from AppData Foxit '
'directories, and unexpected .dll or .drv '
'files in user-controlled paths. Review '
'Windows event logs for token '
'manipulation and anomalous '
'service-driven process launches.',
'remediation_measures': 'Foxit addressed the issue in version '
'2026.2. Additional mitigation '
'strategies include AppLocker policies '
'to restrict unauthorized module loading '
'and monitoring of writable directories '
'used by privileged services.'},
'title': 'Foxit PDF Reader Vulnerability (CVE-2026-57239) Enables '
'SYSTEM-Level Privilege Escalation',
'type': 'Privilege Escalation',
'vulnerability_exploited': 'CVE-2026-57239'}