CVE-2026-91813: Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability
Published Sep 23, 2026
·Updated
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges.
Affected Software
10 affected components
Foxit Foxit PDF Editor/Reader
Foxit FoxitUpdater
All of the following
Any of the following
Foxit PDF Editor<=13.2.5.63482
Foxit PDF Editor>=14.0.0.33046<=14.0.7.33751
Foxit PDF Editor>=2023.1.0.15510<=2023.3.0.23028
Foxit PDF Editor>=2024.1.0.23997<=2024.4.1.27687
Foxit PDF Editor>=2025.1.0.27937<=2025.3.0.35737
Foxit PDF Editor>=2026.1.0.36452<=2026.2.0.39747
Foxit PDF Reader<=2026.2.0.39747
Microsoft Windows
Event History
Sep 23, 2026
CVE Published
via MITRE·07:49 AM
Data Sourced
via MITRE·07:49 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Does exploitation require user interaction?
No. The vulnerability is rated UI:N, indicating that user interaction is not required.
2
What access does an attacker need to exploit this issue?
The attack vector is local (AV:L) and requires low privileges (PR:L). An attacker would need local access and an existing low-privileged account or execution context.