CVE-2026-91800

Executive Summary

CVE-2026-91800 is a local privilege escalation vulnerability in the installer component of Foxit PDF Editor for macOS, caused by insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker with low-privilege access to the host can influence this configuration value so that privileged upgrade operations execute attacker-controlled code with root privileges. The flaw carries a CVSS v3.1 base score of 8.8 and is assessed as UNPATCHED based on currently available evidence.

Technical Analysis

The vulnerability resides in the macOS installer logic used by Foxit PDF Editor during high-privilege upgrade operations. Per the NVD description, the root cause is "insufficient validation of a user-modifiable configuration value during high-privilege upgrades." This maps directly to CWE-732 (Incorrect Permission Assignment for Critical Resource), meaning a resource that should be writable only by a privileged process is instead influenceable — directly or indirectly — by an unprivileged local user, and that influence is then trusted by code running at elevated privilege.

The attack surface is the installer/updater pathway on macOS. macOS installers and updaters frequently run as a privileged helper (for example, via a launchd daemon or an authorization prompt) to perform upgrades that write into system-protected locations. When such a privileged component reads a configuration value — a preference, a plist entry, a manifest, or an upgrade descriptor — that a normal user can modify, the privileged process acts on untrusted input. If that value determines a path, argument, or command that is later executed or loaded, the user gains a channel to inject their own content into a root-context operation.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) confirms the analyst assessment: local attack vector, low complexity, low privileges required, no user interaction, and a scope change because the attacker operates as an unprivileged user but code execution occurs in the installer's root security context. Confidentiality, integrity, and availability impacts are all rated High as a consequence of arbitrary root-level command execution.

Notably, no CVE data provided discloses the specific configuration file, key name, installer binary, or upgrade path involved. No public proof-of-concept, Nuclei template, or exploit code is referenced. The precise mechanism by which the configuration value is rendered user-modifiable (for example, world-writable file permissions, an insecure temporary path, or an environment-derived value) is not documented in the available data and is therefore not asserted here.

The generic exploitation pattern for this class is: (1) an unprivileged local user writes a crafted value into a config resource that the privileged installer will read; (2) the user triggers a high-privilege upgrade; (3) the installer consumes the tampered value, causing attacker-controlled content to be executed or loaded with root privileges. All of these are class-level mechanics consistent with the description; no specific function, path, or parameter names are established by the source data.

Exploitation Scenarios

The attack chain below is inferred at the vulnerability-class level from the NVD description. No public exploit exists, and no specific file, key, or binary names are asserted because the source data does not provide them.

1. Reconnaissance / target identification. The attacker requires local access to a macOS host running Foxit PDF Editor with a low-privilege user account. The attacker identifies that a privileged installer or updater for the product performs high-privilege upgrade operations on the machine (for example, observed via an update prompt, a privileged helper process, or an installed upgrade package). The attacker then identifies the configuration value — the specific input is not documented — that the privileged upgrade path consumes and that the current user is able to modify.

2. Triggering the flaw class. Because the configuration value is user-modifiable and insufficiently validated, the attacker alters it to a malicious or attacker-controlled value. Per CWE-732, this is a trust-boundary failure: the privileged process trusts a resource it should have protected, and it does not validate the value before acting on it.

3. Payload / execution at the vulnerability-class level. The attacker initiates the high-privilege upgrade process. During the upgrade, the installer reads the tampered configuration value while operating as root and uses it in a way that results in execution of arbitrary commands at the elevated privilege level. Because UI interaction is not required (UI:N) and privileges required are low (PR:L), the attacker does not need an administrator password or an interactive victim.

4. Post-exploitation impact. Successful exploitation yields arbitrary command execution as root on the local machine. Given the scope change (S:C) and High C/I/A impact, the attacker can read and modify protected files, install persistent mechanisms (for example, privileged launchd agents), disable security controls, and use the host as a pivot or staging platform. Because the vector is local, the impact is scoped to the compromised endpoint rather than being network-delivered.

No public PoC is available; the attack chain above is inferred from the vulnerability class and the CVSS characterization, not from confirmed exploit artifacts.

Impact Assessment

The primary impact is local privilege escalation from a normal macOS user account to root on hosts where the affected Foxit PDF Editor installer performs high-privilege upgrades. The blast radius is endpoint-scoped (AV:L) rather than network-wide, but the consequences of root-level execution are severe: full control of the host, including the ability to tamper with applications, credentials, and security tooling in ways that only an administrator or root process could otherwise accomplish.

The CVSS subscores support this: AV:L reflects the need for local access; AC:L means no unusual conditions are required once the vulnerable configuration path is reachable; PR:L reflects that only low privileges are needed; UI:N means no victim action is required for the privileged action to be abused; S:C captures the boundary crossing from unprivileged user to root context; and C:H/I:H/A:H reflect total compromise of confidentiality, integrity, and availability across the affected host. The 8.8 base score places this in the High severity range.

Business impact includes: compromise of managed macOS endpoints in regulated or high-value environments; potential lateral movement originating from a fully compromised workstation; loss of integrity of security controls running on the endpoint; and increased incident response cost. Because Foxit PDF Editor is widely deployed in enterprise document-management workflows, any Mac fleet with the product and its updater present should be considered in scope, pending confirmation of the affected version range (not disclosed in available data).

As CISA KEV does not list this CVE and no EPSS score has been assigned by FIRST.org, there is currently no evidence of exploitation in the wild. That does not reduce the severity for well-defended environments, since a local privilege escalation to root is a valuable post-access primitive for any adversary who already holds a low-privilege foothold.

Detection Guidance

The detection rules below target the described behavior: a low-privilege process influencing installer/upgrade configuration that is subsequently consumed by a privileged installer/helper, and the resulting root-context command execution. Because no specific paths or keys are provided, rules are written to alert on suspicious modification of installer-related configuration and on privileged command execution spawning from installer contexts. Tuning is required.

Sigma Rule

title: Suspicious Modification of Foxit PDF Editor Installer Configuration on macOS
id: 9f3b7c2a-1d4e-4b6f-9a21-7c8e5d0f9180
status: experimental
description: Detects user-level modification of Foxit PDF Editor installer/upgrade configuration
  resources consistent with CVE-2026-91800 local privilege escalation via user-modifiable
  configuration consumed during high-privilege upgrades.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91800
author: valtersit.com
date: 2026/01/01
tags:
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026.91800
logsource:
  product: macos
  category: file_event
detection:
  selection_product:
    TargetFilename|contains:
      - 'Foxit'
      - 'com.foxit'
  selection_config:
    TargetFilename|contains:
      - '.plist'
      - 'Updater'
      - 'Update'
      - 'Installer'
  selection_userwritable:
    # alert when the writing process is NOT root and the resource is under a system/privileged path
    TargetFilename|startswith:
      - '/Library'
      - '/private/var'
      - '/Applications'
  condition: selection_product and selection_config and selection_userwritable
falsepositives:
  - Legitimate Foxit updater running with authorization
  - Enterprise software deployment tooling
level: high

YARA Rule

rule CVE_2026_91800_Foxit_macOS_LPE_Config_Tamper
{
    meta:
        description = "Detects files referencing Foxit installer/upgrade configuration resources associated with CVE-2026-91800"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91800"
        severity = "high"

    strings:
        $foxit1 = "Foxit" ascii wide nocase
        $foxit2 = "com.foxit" ascii wide nocase
        $inst1  = "Installer" ascii wide
        $inst2  = "Updater" ascii wide
        $upd1   = "upgrade" ascii wide nocase
        $cfg1   = "Configuration" ascii wide nocase
        $cfg2   = "privileged" ascii wide nocase

    condition:
        filesize < 20MB and
        ($foxit1 or $foxit2) and
        ($inst1 or $inst2 or $upd1) and
        ($cfg1 or $cfg2)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91800 Foxit PDF Editor macOS LPE - Suspicious Upgrade Config Fetch"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"foxit"; nocase; http.uri; content:"update"; nocase; classtype:attempted-user; reference:cve,2026-91800; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91800; metadata:affected_product macos, attack_target Client_Endpoint, created_at 2026_01_01, signature_severity Major, tag CVE_2026_91800; sid:202691800; rev:1;)

Note: because the disclosed vulnerability is purely local, network detection is a supplementary control only and should not be relied upon as the primary detection signal.

Elastic Detection

process where event.type in ("start", "change") and
  process.name in ("installer", "installd", "softwareupdated") and
  process.parent.name in ("Foxit", "FoxitPDFEditor", "FoxitUpdater") and
  process.args like~ ("*/Library/*", "*/private/var/*", "*Updater*", "*Installer*")

Splunk SPL Query

index=endpoint (sourcetype=osquery OR sourcetype=macos_unified_log)
(process_name="installer" OR process_name="installd" OR process_name="softwareupdated")
(Foxit OR foxit OR "com.foxit" OR Updater OR Installer)
| eval suspicious=if(match(_raw, "(?i)(/Library/|/private/var/|root|sudo)"), 1, 0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen
        values(process_name) as procs values(user) as users by host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="macos,foxit,cve_2026_91800,">
  <rule id="100918" level="12">
    <decoded_as>json</decoded_as>
    <field name="product">Foxit</field>
    <field name="action" type="pcre2">(?i)(Updater|Installer|upgrade|configuration)</field>
    <description>CVE-2026-91800: Possible Foxit PDF Editor macOS installer configuration tamper / privileged upgrade abuse</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,pci_dss_10.2.5,gdpr_IV_35.7.d,</group>
  </rule>

  <rule id="100919" level="14">
    <if_sid>100918</if_sid>
    <field name="privilege">root</field>
    <description>CVE-2026-91800: Root-context execution following Foxit installer configuration modification - suspected local privilege escalation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is referenced in the available CVE data, and no affected version range has been disclosed. The guidance below is defensive and does not assume a specific vendor remediation.

1) Immediate mitigations (no patch available):

• Restrict who can modify installer/upgrade configuration resources on managed Macs. Audit the permissions of Foxit-related installer, updater, and preference resources and enforce root/administrator-only ownership where the vendor's design permits; do not leave any installer-read configuration world-writable.
• Disable or defer automatic high-privilege upgrades for Foxit PDF Editor until a validated fix or vendor advisory is available; where feasible, control upgrades centrally with MDM rather than letting the on-device updater run with elevated rights.
• Enforce least privilege on endpoints: eliminate standing local administrator rights for day-to-day accounts, so that any successful escalation remains the only path to root and is more likely to be detected.
• Apply macOS endpoint hardening (TCC protections, Full Disk Access and privileged-helper monitoring) and monitor for tampering with files under /Library, /private/var, and application support directories.
• Deploy the detection rules above and treat alerts on privileged installer behavior as high priority in environments where Foxit is deployed.

2) Patch / upgrade steps:

• Monitor the vendor's official security advisory and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-91800) for a fixed version and affected-range confirmation. Do NOT assume any version is safe in the absence of a vendor statement.
• When a fixed build is released, test it in a controlled ring and roll it out via MDM. Verify the version actually installed, since installer/updater components can differ from the main application version.
• If the vendor issues a hardened installer that validates the configuration value, validate that the fix addresses the root-cause CWE-732 condition (protection of the configuration resource), not merely the specific observed value.

3) Long-term hardening:

• Protect all configuration resources consumed by privileged helpers with restrictive ownership and mode (root:wheel, minimal write bits) and monitor them for changes.
• Establish a change-detection baseline for installer and updater artifacts for all privileged endpoint software, not just Foxit.
• Require signed and notarized installer components and monitor for unsigned or unexpected privileged helpers.
• Incorporate local privilege escalation primitives into endpoint detection engineering so that escalation from a low-privilege foothold is caught even when the initial access vector is benign.
• Maintain an inventory of installed macOS applications and their auto-update mechanisms to rapidly map exposure when a vendor vulnerability is disclosed.

References

• NVD — CVE-2026-91800: https://nvd.nist.gov/vuln/detail/CVE-2026-91800
• MITRE CWE-732 — Incorrect Permission Assignment for Critical Resource: https://cwe.mitre.org/data/definitions/732.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91800 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Foxit Security Advisories (monitor for a vendor fix and affected version range): https://www.foxit.com/support/security-bulletins.html

Threat actor campaigns / exploit-in-the-wild evidence: none identified. CISA KEV does not list this CVE, no public PoC or exploit code is referenced, and no EPSS score has been assigned by FIRST.org as of this report. Exploitation status should be re-evaluated upon release of a vendor advisory or public research.