A recently disclosed vulnerability in Foxit PDF Reader may allow a local attacker with existing code execution to elevate their privileges to NT AUTHORITYSYSTEM.
This issue, tracked as CVE-2026-57239, affects Foxit PDF Reader installations prior to version 2026.2 and arises from the insecure handling of an updater workflow triggered by a user-writable file in the ProgramData directory.
Foxit PDF Reader Flaw
Security researcher Luke Paris identified the flaw by examining Foxit’s update components using Process Monitor and reverse-engineering tools.
The attack requires the adversary to already execute code as a low-privileged Windows user, classifying it as a local privilege escalation vulnerability rather than a remote code execution flaw.
However, successful exploitation grants the attacker full control of the affected Windows host, leading to credential theft, tampering with security tools, persistence, and preparation for lateral movement.
The vulnerability centers on the FoxitPDFReaderUpdateService.exe service, which operates with NT AUTHORITYSYSTEM privileges. This service monitors files, including C:ProgramDataFoxitSoftwareFoxitPDFReaderFoxitData.txt.
Since standard users can write to the relevant ProgramData directory, an attacker can supply a crafted, encrypted update request instructing the privileged service to launch FoxitPDFReaderUpdater.exe from the current user’s AppData directory.
Although Foxit’s updater validates executable names and signing information, preventing a straightforward replacement of the updater binary, the researcher discovered a viable sideloading route.
By forcing the updater to display a graphical update prompt and interacting with a link in that interface, it could load a maliciously crafted winspool.drv file from its working directory.
Since a Windows .drv file is a portable executable module capable of running code through DllMain, the malicious module executes in the context of the SYSTEM-launched updater.
The proof-of-concept chain involves a writable control file, predictable service behavior, and an unsafe module loading condition.
The researcher reported that the FoxitData.txt payload uses AES encryption with a hard-coded key and requires UTF-16 little-endian encoding, allowing attackers to construct requests that activate the privileged updater flow. Foxit has reportedly patched this issue in version 2026.2.
Organizations should immediately update Foxit PDF Reader and review endpoints for unauthorized .dll or .drv files under %APPDATA%FoxitSoftwareContinuousAddonFoxitPDFReader.
Additionally, defenders should monitor writes to FoxitData.txt by processes not signed by FOXIT SOFTWARE INC., as well as Windows process creation (Event ID 4688) and unusual token-related activity.
Implementing application control policies through AppLocker or Windows Defender Application Control can further restrict malicious module loading and reduce exposure to DLL sideloading.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
