Read Time:3 Minute, 36 Second
Foxit PDF Reader, one of the more widely used alternatives to Adobe’s own reader, has been carrying a local privilege-escalation flaw in its update mechanism that lets a standard Windows user ride a background service all the way to full SYSTEM control. The issue is tracked as CVE-2026-57239 and has been fixed in Foxit version 2026.2.
An Updater With Too Much Trust
The root of the problem sits in how Foxit’s updater component talks to a companion Windows service, FoxitPDFReaderUpdateService.exe, which runs with NT AUTHORITY\SYSTEM privileges. That service continuously watches a handful of files, including a status file called FoxitData.txt stored in the shared ProgramData directory — a location any low-privileged local user can write to.
Researchers found that the updater executable, which lives in a normal user’s AppData folder, attempts to load several external library files at startup, including one styled after a Windows driver component, winspool.drv. Unlike the sideload protections Foxit has built into other parts of the application, this particular load path wasn’t properly validated, so an attacker who already has some form of code execution on the machine can drop a malicious file in its place and have it loaded inside the updater’s process.
From Sideloading to SYSTEM
On its own, that sideload only grants execution inside the unprivileged updater. The escalation to SYSTEM requires a second step: manipulating FoxitData.txt so that the privileged update service is tricked into relaunching the (now-compromised) updater executable with elevated rights.
That’s not as simple as writing plain text, however. Reverse engineering of the service showed that FoxitData.txt is expected to contain instructions encrypted with AES-128-CBC, using a key hardcoded directly in the binary. Once researchers recovered the key and worked out the encoding format, they were able to craft valid encrypted payloads that cause the service to launch the updater with SYSTEM privileges — at which point the earlier sideloaded file executes with full system rights.
Foxit had already closed off some sideloading routes in earlier releases, but researcher Luke Paris found an alternate path that survived those fixes: forcing the updater to display a specific GUI prompt and interacting with it in a way that causes the application to attempt loading external modules all over again, reopening the door even on patched sideload protections.
Real-World Impact
Because the attack requires local access or an existing foothold to begin with, this isn’t a remote, zero-click threat on its own. Its real value to an attacker is as a second stage: a way to turn a limited initial compromise, such as a phishing payload that runs with standard-user rights, into full administrative control of the endpoint. That makes it especially relevant in:
- Targeted intrusions where an attacker already has a low-privilege shell
- Post-compromise lateral movement inside a corporate environment
- Exploit chains that pair a separate initial-access bug with this escalation step
A successful chain hands the attacker complete control of the machine, including the ability to run arbitrary commands, disable or tamper with security tooling, and establish persistence.
Detection and Mitigation
Foxit has patched the underlying issue in version 2026.2, and organizations running Foxit PDF Reader should prioritize updating, particularly on machines where users have local admin restrictions that this bug would otherwise bypass. Until every endpoint is updated, defenders have a few practical detection angles:
- Monitor for unauthorized writes to FoxitData.txt in the ProgramData directory
- Watch for unusual process launches originating from user AppData Foxit folders, especially ones that spawn with SYSTEM tokens
- Flag unexpected .dll or .drv files appearing in user-writable Foxit installation paths
- Review Windows event logs for token manipulation and anomalous service-driven process creation
Beyond patching, application control policies such as AppLocker can help by restricting which modules are allowed to load in the context of privileged services, closing off this kind of sideload-to-SYSTEM path even if a new variant surfaces later.
The broader lesson here isn’t specific to Foxit: any privileged service that trusts input from a world-writable file, or that loads libraries without strict validation, is a potential escalation path. As endpoint security has made initial access harder, attackers have increasingly turned to exactly this kind of “boring” logic flaw to finish the job once they’re already inside.
Share
Facebook
Twitter
Pinterest
LinkedIn
