CVE-2026-91798

Executive Summary

CVE-2026-91798 is a local privilege escalation vulnerability in the update daemon of Foxit PDF Editor and Foxit PDF Reader. The flaw stems from insecure file permission configuration (CWE-732) that allows a regular, unprivileged local user to modify a configuration file consumed by the update daemon, which runs with higher privileges. Successful exploitation can result in arbitrary script execution in the context of the privileged update service, yielding high confidentiality, integrity, and availability impact with a scope change (CVSS 8.8). No public proof-of-concept, exploit code, or vendor patch is currently available.

Technical Analysis

The vulnerability class is Insecure Permissions / Incorrect Permission Assignment for a Critical Resource (CWE-732). The affected component is the update daemon — a background service that periodically checks for and applies updates to Foxit PDF Editor/Reader. According to the NVD description, the root cause is an insecure permission configuration that leaves a configuration file writable by regular (non-privileged) users. Because the update daemon executes with elevated privileges and consumes that configuration file, any unprivileged local user who can write to the file can influence the daemon's behavior.

The precise mechanism by which the modified configuration leads to code execution is not fully specified in the available data: the description states that modification "may lead to arbitrary script execution with higher privileges." This indicates that the configuration file governs some scriptable or command-driven behavior executed by the daemon, such that an attacker-controlled configuration entry is executed by the privileged process. No specific file names, configuration keys, daemon executable paths, or script handlers are disclosed in the provided description, and none should be assumed.

Attack surface characteristics:

• Access vector: Local (AV:L). The attacker must already hold a foothold on the host as a regular user or be able to influence a local user session.
• Privileges required: Low (PR:L) — a standard user account is sufficient.
• User interaction: None (UI:N) — the daemon processes the tampered configuration without requiring a victim to click or approve anything.
• Scope: Changed (S:C) — the vulnerable component (user-writable config surface) is used to affect a different security authority (the privileged update daemon), which is why scope is marked Changed rather than Unchanged.
• Impact subscores: Confidentiality, Integrity, and Availability are all High (C:H/I:H/A:H), reflecting the ability to run code at elevated privilege.

The combination of low attack complexity (AC:L) and low privileges required makes this a practical post-compromise escalation primitive rather than a remote initial-access vector.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the NVD description and the CWE-732 vulnerability class. No specific implementation details (file names, script handlers, daemon paths) are known and are therefore not fabricated.

1. Reconnaissance / target identification. The attacker obtains local access to a Windows or Linux host (or a user session) on which Foxit PDF Editor/Reader is installed with the update daemon present. The attacker enumerates the update daemon's configuration file location and inspects file/directory permissions to determine whether the configuration file is writable by a non-administrative account — the defining misconfiguration in CWE-732.

2. Trigger of the specific flaw class. Because the configuration file has insecure permissions, the unprivileged attacker can write to it. The attacker modifies configuration values that the update daemon reads and acts upon. This is the core of the flaw: the daemon trusts a configuration artifact that the attacker can control, without validating ownership or integrity.

3. Payload / execution method (class-level). The modified configuration drives the privileged update daemon to execute attacker-supplied script content. Per the NVD description, this "may lead to arbitrary script execution with higher privileges." The exact configuration directive or script handler is not disclosed; at the vulnerability-class level, the attacker substitutes or injects a script reference that the daemon executes under its own elevated token.

4. Post-exploitation impact. The executed script runs with the daemon's higher privileges, granting the attacker effective elevation (e.g., SYSTEM/root context, depending on how the daemon is installed). From there the attacker can disable security controls, persist via privileged services or scheduled tasks, access sensitive files, or pivot laterally — consistent with the High CIA subscores and Changed scope.

This is a post-compromise privilege escalation technique (T1068). It is not a remote, pre-authentication exploit.

Impact Assessment

Foxit PDF Editor and Foxit PDF Reader are widely deployed in enterprise endpoint fleets for PDF viewing, editing, and forms processing, so the affected population is broad. However, exploitation requires an existing local foothold with at least a standard user account, limiting the threat to escalation and lateral-movement stages of an intrusion rather than mass remote compromise.

• CVSS base 8.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
• Confidentiality (H): privileged execution enables reading sensitive local data and credentials.
• Integrity (H): attacker can alter system configuration, binaries, or security tooling at elevated privilege.
• Availability (H): privileged code can disrupt or disable the daemon or host services.
• Scope (Changed): the compromise of the user-writable config surface crosses a privilege boundary into the privileged daemon's security authority.

Blast radius: hosts where Foxit PDF Editor/Reader is installed with the vulnerable update daemon, and where the configuration file is writable by non-privileged users. In managed fleets, a single low-privilege account can be leveraged to gain administrative control of an endpoint, materially raising risk on shared/multi-user systems and VDI environments.

Detection Guidance

Sigma Rule

title: Potential Foxit Update Daemon Config Tampering (CVE-2026-91798)
id: 8f2c1a44-7b9e-4d21-9c3a-0f5e6a1b2c30
status: experimental
description: Detects writes/modifications to Foxit update daemon configuration files by non-system or non-administrative user contexts, indicating possible exploitation of CWE-732 local privilege escalation (CVE-2026-91798).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91798
author: valtersit.com
date: 2026-01-01
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-91798
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Foxit'
    TargetFilename|endswith:
      - '.ini'
      - '.cfg'
      - '.conf'
      - '.json'
  selection_action:
    EventType:
      - 'Create'
      - 'Write'
      - 'SetModification'
  filter_system:
    User|endswith:
      - 'SYSTEM'
      - '$'
    User|contains:
      - 'TrustedInstaller'
  condition: selection_path and selection_action and not filter_system
falsepositives:
  - Legitimate Foxit updater service operations running as SYSTEM
  - Administrative configuration utilities
level: medium

YARA Rule

rule CVE_2026_91798_Foxit_Update_Config_Tamper
{
    meta:
        description = "Detects configuration artifacts associated with Foxit update daemon tampering (CVE-2026-91798)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91798"
        date = "2026-01-01"
        severity = "high"

    strings:
        $foxit = "Foxit" ascii wide nocase
        $updater = "update" ascii wide nocase
        $daemon = "daemon" ascii wide nocase
        $cfg1 = "update_config" ascii wide nocase
        $cfg2 = "updater" ascii wide nocase
        $script1 = ".ps1" ascii wide nocase
        $script2 = ".bat" ascii wide nocase
        $script3 = ".cmd" ascii wide nocase
        $script4 = "/bin/sh" ascii wide nocase

    condition:
        $foxit and ($cfg1 or $cfg2 or ($updater and $daemon)) and any of ($script*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91798 Foxit Update Daemon Component Retrieval - Potential LPE Follow-on"; flow:established,to_client; http.host; content:"update"; nocase; http.uri; content:"Foxit"; nocase; classtype:attempted-admin; reference:cve,2026-91798; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91798; metadata:created_at 2026_01_01, affected_product Foxit_PDF_Editor_Reader; sid:202691798; rev:1;)

Elastic Detection

file where process.name != null and
  file.name : ("*.ini" or "*.cfg" or "*.conf" or "*.json") and
  file.path : "*Foxit*" and
  event.action : ("creation" or "modification" or "change") and
  not user.name : ("SYSTEM" or "TrustedInstaller") and
  not process.name : ("FoxitUpdater.exe" or "FoxitReaderUpdater.exe")

Splunk SPL Query

index=endpoint (EventCode=11 OR EventCode=2)
| where like(TargetFilename, "%Foxit%") AND (like(TargetFilename, "%.ini") OR like(TargetFilename, "%.cfg") OR like(TargetFilename, "%.conf") OR like(TargetFilename, "%.json"))
| search NOT (User="SYSTEM" OR User="*$" OR User="TrustedInstaller")
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as files by host User
| where count > 0

Wazuh OSSEC Rule

<group name="foxit,cve-2026-91798,privilege_escalation,">
  <rule id="2026917" level="10">
    <if_sid>100000</if_sid>
    <field name="file.path">Foxit</field>
    <field name="event.action">write|modify|create</field>
    <description>CVE-2026-91798 - Possible tampering of Foxit update daemon configuration file by a non-privileged user (potential local privilege escalation)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,attack.t1068,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix version, workaround, or affected-version range has been published in the available data.

1) Immediate mitigations

• Audit and remediate file permissions on Foxit update daemon configuration files: ensure they are writable only by the daemon's own service account and administrators/SYSTEM. Remove write access for standard users and groups such as "Users" or "Authenticated Users."
• Harden the parent directories of the configuration file to prevent takeover via directory-move or rename techniques.
• Where feasible, restrict or temporarily disable the Foxit update daemon on high-value endpoints until a patch is available, weighing the loss of automatic updates.
• Monitor endpoint file-event telemetry for non-privileged writes to Foxit configuration paths (see Detection Guidance).

2) Patch / upgrade steps

• No official patch is currently available. Monitor Foxit's official security advisories page and the NVD entry for CVE-2026-91798 for the first patched release.
• Once a vendor fix is released, prioritize deployment to all endpoints with Foxit PDF Editor/Reader, then re-verify that configuration file permissions are correctly restricted post-upgrade.

3) Long-term hardening

• Apply the principle of least privilege to all vendor updater services: configuration consumed by privileged daemons must not be writable by unprivileged principals (CWE-732 remediation).
• Enforce application allowlisting and script-execution controls (e.g., PowerShell constrained language mode, ASR rules) to limit the impact of arbitrary script execution.
• Maintain software inventory and rapid patch cadence for PDF readers and other frequently targeted endpoint software.
• Continuously monitor for privilege-escalation tooling and anomalous child processes spawning from update daemons.

References

• NVD — CVE-2026-91798: https://nvd.nist.gov/vuln/detail/CVE-2026-91798
• MITRE CWE-732 — Incorrect Permission Assignment for a Critical Resource: https://cwe.mitre.org/data/definitions/732.html
• MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• FIRST — EPSS (no score available for this CVE at time of writing): https://www.first.org/epss/
• Foxit Security Advisories (monitor for patch publication): https://www.foxit.com/support/security-bulletins.html

No exploit-in-the-wild evidence, public PoC, or associated threat actor campaign has been identified for CVE-2026-91798 in the available data. CISA KEV status: not listed.