Foxit PDF Reader has been found vulnerable to a local privilege escalation flaw that allows standard Windows users to gain full SYSTEM-level control under specific conditions.
The issue, tracked as CVE-2026-57239, was disclosed following research into Foxit’s updater and service architecture and represents a high-impact post-exploitation pathway, although it requires prior code execution on the target system.
The vulnerability originates from insecure interactions between the Foxit updater component and a privileged Windows service running as NT AUTHORITYSYSTEM.
During analysis, researchers observed that the updater executable located in the user’s AppData directory performed multiple library load attempts, including references to driver-style modules such as winspool.drv.
Unlike traditional DLL sideload protections implemented in the application, this driver file was not properly validated, allowing attackers to place a malicious proxy file and achieve code execution within the updater context.
Although initial sideloading provided execution, privilege escalation required chaining this behavior with the FoxitPDFReaderUpdateService.exe process.
This service continuously monitors specific files, including FoxitData.txt in the ProgramData directory, which is writable by low-privileged users.
Foxit Updater Vulnerability
By manipulating this file, researchers discovered that it was possible to influence the service into launching the updater executable with SYSTEM privileges.
Further reverse engineering revealed that the service expects encrypted instructions within FoxitData.txt. These instructions are protected using AES-128-CBC encryption with a hardcoded key embedded in the binary.
Once the encryption scheme and encoding format were understood, it became possible to craft valid payloads that trigger execution of the updater process under elevated privileges.
Despite built-in safeguards such as certificate validation for executables, attackers could bypass restrictions by combining the privileged execution flow with sideloading techniques.
In a working exploit chain, a malicious driver file placed alongside the updater executable is loaded when the service launches the updater, effectively granting SYSTEM-level code execution.
Although Foxit previously mitigated sideloading vectors, researcher Luke Paris discovered an alternative exploitation path involving user interface interaction.
By forcing the updater to display a GUI prompt and triggering specific actions, the application attempted to load external modules again, enabling successful exploitation even after initial patches.
Successful exploitation results in full control over the affected system, including the ability to execute arbitrary commands, manipulate security controls, and maintain persistence.
Because the vulnerability requires local access or an existing foothold, it is most relevant in targeted attacks, post-compromise scenarios, or chained exploits.
Organizations can detect potential exploitation by monitoring unauthorized modifications to FoxitData.txt and unusual process execution originating from the AppData Foxit directories.
The presence of unexpected .dll or .drv files in user-controlled Foxit paths, combined with SYSTEM-level process creation events, may indicate abuse. Security teams should also review Windows event logs for token manipulation and anomalous service-driven process launches.
Foxit has addressed the issue in version 2026.2, and users are strongly advised to update immediately. Additional mitigation strategies include enforcing application control policies such as AppLocker to restrict unauthorized module loading and monitoring file system activity in writable directories used by privileged services.
This vulnerability highlights the risks associated with improper validation of inter-process communication and library loading mechanisms, reinforcing the need for strict boundary enforcement between user-controlled inputs and SYSTEM-level services.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
