Foxit PDF Reader Updater Critical Vulnerability Lets Attackers Gain SYSTEM Privileges

Key Takeaways

• A critical local privilege escalation (LPE) flaw, CVE-2026-57239, has been identified in Foxit PDF Reader.
• The vulnerability allows a standard Windows user with prior code execution to elevate privileges to NT AUTHORITYSYSTEM.
• The exploit chain involves insecure interactions between Foxit’s updater and a privileged service, leveraging DLL sideloading and file manipulation.
• Foxit has released a patch in version 2026.2, and users are urged to update immediately.

A severe local privilege escalation (LPE) vulnerability has been discovered in Foxit PDF Reader, enabling attackers to gain full SYSTEM-level control on compromised Windows systems. The flaw, designated CVE-2026-57239, provides a high-impact post-exploitation pathway for adversaries who have already achieved initial code execution on a target machine.

The Vulnerability Unpacked: From User to System

The core of the vulnerability lies in the insecure communication and file handling between Foxit’s updater component and a privileged Windows service that operates with NT AUTHORITYSYSTEM permissions. During a detailed analysis, researcher Luke Paris discovered that the updater executable, typically found in the user’s AppData directory, made multiple attempts to load libraries, including driver-style modules like winspool.drv.

Unlike other DLL sideloading vectors that Foxit had previously addressed, the validation for this specific driver file was inadequate. This oversight created an opening for attackers to place a malicious proxy file, leading to arbitrary code execution within the context of the updater.

Achieving SYSTEM-level privileges, however, required chaining this initial sideloading with the FoxitPDFReaderUpdateService.exe process. This service continuously monitors specific files, notably FoxitData.txt within the ProgramData directory. Crucially, this directory is writable by low-privileged users, making it a prime target for manipulation.

Exploiting the Update Mechanism

By tampering with FoxitData.txt, researchers found it was possible to trick the FoxitPDFReaderUpdateService into launching the updater executable with elevated SYSTEM privileges. Further reverse engineering efforts revealed that the service expects encrypted instructions within FoxitData.txt, protected by AES-128-CBC encryption using a hardcoded key embedded in the service binary.

Once the encryption scheme and encoding format were deciphered, it became feasible to craft valid payloads that compel the service to execute the updater process under SYSTEM privileges. Even with built-in safeguards like certificate validation for executables, attackers could bypass these restrictions by combining the privileged execution flow with the aforementioned sideloading techniques.

In a fully functional exploit chain, a malicious driver file placed alongside the updater executable would be loaded when the service initiates the updater, effectively granting SYSTEM-level code execution. This means that a local attacker could gain complete control over the affected system, enabling them to run arbitrary commands, alter security settings, and establish persistence.

Despite previous attempts by Foxit to mitigate sideloading, researcher Luke Paris identified an alternative exploitation path that involved user interface interaction. By forcing the updater to display a GUI prompt and triggering specific actions, the application would again attempt to load external modules, allowing for successful exploitation even after initial patches. Since this vulnerability requires local access or an existing foothold, it is most relevant in targeted attacks, post-compromise scenarios, or as part of a multi-stage exploit chain.

What You Should Do

• Update Immediately: Users are strongly advised to update Foxit PDF Reader to version 2026.2 or later, as this release addresses the vulnerability.
• Monitor File System Activity: Organizations should monitor for unauthorized modifications to FoxitData.txt and unusual process execution originating from Foxit directories within AppData.
• Detect Malicious Files: Look for unexpected .dll or .drv files in user-controlled Foxit paths, especially when combined with SYSTEM-level process creation events.
• Review Event Logs: Security teams should review Windows event logs for signs of token manipulation and anomalous service-driven process launches.
• Enforce Application Control: Implement application control policies, such as AppLocker, to restrict unauthorized module loading and enhance system integrity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.