Foxit PDF Reader Vulnerability Allows Standard Users SYSTEM-Level Privilege Escalation
A local privilege escalation vulnerability (CVE-2026-57239) in Foxit PDF Reader allows standard Windows users to gain SYSTEM-level control by manipulating updater service interactions.
A critical local privilege escalation vulnerability, identified as CVE-2026-57239, has been discovered in Foxit PDF Reader, enabling standard Windows users to achieve full SYSTEM-level control over affected devices. This flaw, detailed by researchers, exploits weaknesses in the software's updater and service architecture, presenting a significant post-exploitation pathway for attackers who already have initial code execution on a target system.
The vulnerability stems from insecure interactions between the Foxit updater executable, typically located in a user's AppData directory, and a privileged Windows service running under the NT AUTHORITY\SYSTEM account. Researchers observed that the updater executable attempted to load various library files, including driver-like modules such as winspool.drv. Crucially, this driver file was not subjected to proper validation, creating an opportunity for attackers to place a malicious proxy driver file. This allows for code execution within the context of the updater process.
While initial sideloading of a malicious driver provided code execution, achieving privilege escalation required chaining this with the FoxitPDFReaderUpdateService.exe process. This service actively monitors specific files, including FoxitData.txt, which resides in the ProgramData directory and is writable by low-privileged users. By manipulating this file, attackers can trick the service into launching the updater executable with SYSTEM privileges.
Further investigation revealed that the service expects encrypted instructions within FoxitData.txt, protected by AES-128-CBC encryption using a hardcoded key found within the binary. Once the encryption scheme and encoding format were deciphered, it became possible to craft malicious payloads. These payloads, when placed in FoxitData.txt, trigger the updater process to execute with elevated SYSTEM privileges.
Even with existing security measures like certificate validation for executables, attackers can bypass these restrictions by combining the privileged execution flow with sideloading techniques. In a successful exploit chain, a malicious driver file placed alongside the updater executable is loaded when the service launches the updater, effectively granting SYSTEM-level code execution. Although previous patches aimed to mitigate sideloading vectors, researchers found an alternative exploitation path involving user interface interactions that could still enable exploitation.
The impact of a successful exploit is profound, granting attackers complete control over the compromised system. This includes the ability to execute arbitrary commands, disable security controls, install persistent backdoors, and exfiltrate sensitive data. Given the requirement for local access or an existing foothold, this vulnerability is most pertinent in targeted attacks, post-compromise scenarios, or as part of a chained exploit.
Foxit has addressed this critical vulnerability by releasing version 2026.2 of its PDF Reader. Users are strongly urged to update to the latest version immediately to mitigate the risk. Security teams can enhance detection by monitoring for unauthorized modifications to FoxitData.txt, unusual process executions originating from Foxit directories in AppData, and the presence of unexpected driver or DLL files in user-controlled Foxit paths, especially when correlated with SYSTEM-level process creation events.
This incident underscores the persistent risks associated with improper validation of inter-process communication and library loading mechanisms, particularly when user-controlled data can influence privileged services. Organizations should reinforce application control policies, such as AppLocker, to restrict unauthorized module loading and implement robust file system monitoring in directories used by privileged services to prevent similar attacks.