CVE-2026-91812: Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability
Published Sep 23, 2026
·Updated
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges.
Affected Software
1 affected component
Foxit Foxit PDF Editor/Reader
Event History
Sep 23, 2026
CVE Published
via MITRE·07:49 AM
Data Sourced
via MITRE·07:49 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access and conditions does an attacker need to exploit this?
An attacker needs to be in a man-in-the-middle position for the update traffic. Exploitation also requires user interaction, and the attack complexity is rated high; no prior privileges are required.
2
What is the likely impact if exploitation succeeds?
The attacker may bypass certificate validation and package integrity checks in the update mechanism, enabling arbitrary code execution with system privileges. The reported impact includes high confidentiality, integrity, and availability effects, with scope changed.