CVE-2026-91803

Executive Summary

CVE-2026-91803 is a local privilege escalation vulnerability in the updater component of Foxit PDF Editor and Foxit PDF Reader, caused by unsafe loading of dynamic-link libraries (DLLs) from a user-writable directory during high-privilege operations (CWE-427, Uncontrolled Search Path Element). Because the flaw is triggered locally with low privileges and requires no user interaction, an attacker who already holds a foothold on a Windows endpoint can elevate to SYSTEM or Administrator integrity, yielding high confidentiality, integrity, and availability impact across the scope of the privileged process. No public proof-of-concept, exploit code, or Nuclei template exists at the time of writing, and no vendor patch has been confirmed, leaving affected fleets exposed pending Foxit's remediation.

Technical Analysis

Foxit PDF Editor and Foxit PDF Reader both ship an update mechanism ("updater") responsible for checking for, downloading, and applying product updates. This updater installs a service or scheduled task/per-user-started process that runs at high privilege (typically NT AUTHORITY\SYSTEM) in order to write files into protected installation directories such as Program Files. CVE-2026-91803 concerns the way this privileged stage resolves dynamic-link libraries: per CWE-427, an uncontrolled search path element means the privileged process resolves a DLL through a path that a non-privileged local user can write to or control.

Three conditions make this exploitable:

1. Elevation of privilege boundary. The updater operation runs at a higher privilege level than the attacker. A DLL it loads inherits that token, so code in the DLL executes as SYSTEM/Administrator.
2. User-writable resolution path. The NVD description explicitly states the DLL is loaded from a "user-writable directory." This is the classic vulnerable pattern: the binary either omits a full path qualifier on the loaded module, searches the current working directory, or relies on a directory that appears early in the Windows loader search order but is writable by the invoking user (for example the directory the updater is launched from, or a per-user temp/log/update staging location).
3. No integrity gating on the loaded module. Because the module name is not resolved to a trusted, Protected-Process-Light- or ACL-hardened location, no signature or path validation stops the substituted library from being accepted.

The CVSS vector confirms the operational profile. AV:L (Local) — the attacker must already have code execution on the host. AC:L (Low) — no special conditions or race complexity beyond satisfying the search-order condition. PR:L (Low) — no administrative rights are needed to plant the payload. UI:N (None) — the victim does not have to approve anything; the privileged operation can be induced or awaited. S:C (Changed) — the exploited vulnerable component (the updater) and the impacted component (the full system running under the elevated token) are different, so the scope is changed. C:H/I:H/A:H — a successful hijack yields full control of confidentiality, integrity, and availability at the elevated privilege level.

The core mechanism is therefore a DLL search order hijack (T1574.001) leveraged for privilege escalation (T1068): a malicious DLL with the name expected by the privileged updater is placed in the user-writable location the updater searches; when the updater executes its high-privilege work, Windows loads the attacker's DLL, and its DllMain/export code runs with elevated rights. No public exploit exists, so the exact module name, the exact writable path, and the precise invocation trigger (service start, scheduled task, COM activation, or updater relaunch) are not documented in the available data and are not asserted here.

The absence of affected-version data means defenders cannot rely on a version cutoff for exposure triage. Any Foxit PDF Editor/Reader installation whose updater performs privileged DLL loading from a writable location should be treated as potentially affected until Foxit publishes a fixed build.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class (CWE-427 DLL search order hijack in a privileged updater) and constrained to what the NVD description states.

Step 1 — Reconnaissance / target identification. The attacker, already operating with low-privileged local code execution on a Windows endpoint (for example via a phished document, a malicious macro, a browser exploit, or a commodity loader), enumerates installed software to confirm Foxit PDF Editor or Foxit PDF Reader is present. The attacker inspects the updater's privileged execution context — whether it runs as SYSTEM via a service or scheduled task, and which directory the updater process loads DLLs from when it performs its high-privilege operations. The key discovery is identifying a directory the updater searches that the low-privileged user can write to ("a user-writable directory" per the description).

Step 2 — Triggering the specific flaw class. The attacker drops a crafted DLL into that user-writable, attacker-controllable location. The DLL is named to match a module the privileged updater expects to load but does not resolve through a trusted, non-writable path. This is the controlled search path element: the loader resolves the attacker's file instead of a legitimate library.

Step 3 — Payload / execution method. The attacker causes or waits for the privileged updater operation to run (the description notes the flaw occurs "during high-privilege operations"). When the updater, running elevated, loads the planted DLL, the DLL's initialization or exported function code executes in the elevated process context. The payload at this stage is arbitrary code — a SYSTEM shell, a service-injection implant, credential harvesting, or a defense-evasion agent — and executes with the updater's token. No specific function names or code patterns are asserted because none are documented in the source data.

Step 4 — Post-exploitation impact. With code running at SYSTEM/Administrator integrity (S:C, C:H/I:H/A:H), the attacker can persist via services or scheduled tasks, disable or tamper with endpoint protection, dump credentials (LSASS), move laterally, and fully own the host. Because the action is local and requires no user prompt (UI:N), the elevation is silent to the victim, extending dwell time.

Impact Assessment

Affected systems. Windows endpoints running Foxit PDF Editor and/or Foxit PDF Reader. Foxit products are widely deployed in enterprise document workflows, help desks, finance, legal, and government environments — anywhere PDF editing/reading is a standard desktop tool — so the potential blast radius spans most managed Windows estates that have not excluded or hardened the Foxit updater.

Business impact. A local privilege escalation of this class is a force multiplier, not a standalone initial-access vector. On its own it does not reach an unauthenticated remote attacker; however, chained after any low-privileged foothold (malicious PDF delivery is a natural fit for a PDF vendor's user base), it converts limited access into full host compromise. Full SYSTEM control enables credential theft, ransomware staging, lateral movement, and evasion of monitoring, with direct consequences for regulatory exposure (confidentiality of documents and credentials) and operational continuity (availability of endpoints).

CVSS interpretation. The base score of 8.8 (High) derives from AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The elevated severity is driven by three factors: the changed scope (compromise escalates from the updater component to the whole system), the unanimous High CIA impact, and the absence of any user interaction or elevated precondition beyond a low-privileged local presence.

Exploitability posture. EPSS has not been scored by FIRST.org; no value should be assumed. CISA KEV does not list this CVE; there is no confirmed exploit-in-the-wild evidence in the provided data. With PoC status None and no public exploit code, the immediate likelihood of widespread weaponization is lower than for an internet-facing RCE — but LPE DLL-hijack techniques are well-understood, so weaponization after advisory publication should be anticipated.

Detection Guidance

Because the primary attack artifact is a masquerading DLL loaded by the Foxit updater from a user-writable path, detection should combine process/file telemetry (which program loaded which module from which directory), image-load auditing, and network signatures for updater-channel activity. The rules below are pattern-based starting points; tune paths, module names, and updater process names for the environment once Foxit publishes authoritative technical details.

Sigma Rule

title: Potential Foxit Updater DLL Search Order Hijack (CVE-2026-91803)
id: 8f2a1c74-3b6e-4d9a-9c1f-foxit91803a
status: experimental
description: Detects a DLL loaded by a Foxit updater process from a user-writable
  directory, consistent with CWE-427 DLL search order hijacking for privilege escalation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91803
author: valtersit.com
date: 2026-01-01
tags:
  - attack.privilege-escalation
  - attack.t1574.001
  - attack.t1068
  - cve.2026.91803
logsource:
  category: image_load
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\FoxitUpdater.exe'
      - '\FoxitPDFEditorUpdater.exe'
      - '\FoxitReaderUpdater.exe'
  filter_trusted_paths:
    ImageLoaded|startswith:
      - 'C:\Program Files\Foxit Software\'
      - 'C:\Program Files (x86)\Foxit Software\'
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  selection_suspicious_path:
    ImageLoaded|contains:
      - '\Users\'
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Downloads\'
  condition: selection_process and selection_suspicious_path and not filter_trusted_paths
falsepositives:
  - Legitimate Foxit updater loading third-party plugin DLLs from a user profile directory
level: high

YARA Rule

rule CVE_2026_91803_Foxit_Updater_DLL_Hijack
{
    meta:
        description = "Identifies DLLs placed under user-writable directories and named to masquerade as a module loaded by the Foxit updater (CVE-2026-91803, CWE-427)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91803"
        date = "2026-01-01"
        severity = "high"
    strings:
        $mz = { 4D 5A }
        $pe = "PE\x00\x00"
        $dll = ".dll"
        $exp = "DllMain"
        $foxit = "Foxit" ascii wide nocase
        $upd = "updater" ascii wide nocase
    condition:
        $mz at 0 and $pe and $dll and
        (uint16(0) == 0x5A4D) and
        (
            (any of ($foxit, $upd)) or $exp
        )
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91803 Possible Foxit Updater Masquerading Update Channel"; flow:established,to_server; http.user_agent; content:"Foxit"; http.uri; content:"update" nocase; content:".dll" nocase; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2026-91803; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91803; classtype:attempted-user; sid:202691803; rev:1;)

Note: The NVD description is local-only and documents no network endpoint; this signature targets anomalous fetches of DLL payloads by a Foxit-branded updater user-agent, which is a heuristic indicator rather than a deterministic detection. It will require tuning and may produce false positives.

Elastic Detection

process where process.name : ("FoxitUpdater.exe", "FoxitPDFEditorUpdater.exe", "FoxitReaderUpdater.exe") and
  event.action == "load" and
  dll.path : ("*\\Users\\*", "*\\AppData\\*", "*\\Temp\\*", "*\\ProgramData\\*")

Splunk SPL Query

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventID=7
| where match(Image, "(?i)Foxit.*Updater\.exe$")
| where NOT match(ImageLoaded, "(?i)^(C:\\\\Program Files( \(x86\))?\\\\Foxit Software\\\\|C:\\\\Windows\\\\System32\\\\|C:\\\\Windows\\\\SysWOW64\\\\)")
| where match(ImageLoaded, "(?i)(\\\\Users\\\\|\\\\AppData\\\\|\\\\Temp\\\\|\\\\ProgramData\\\\|\\\\Downloads\\\\)")
| stats count min(_time) as first_seen max(_time) as last_seen values(ImageLoaded) as dlls by ComputerName, User, Image
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="windows,sysmon,privilege_escalation,cve_2026_91803">
  <rule id="202691803" level="12">
    <if_sid>61609</if_sid>
    <field name="win.eventdata.image">(?i)Foxit.*Updater\.exe$</field>
    <field name="win.eventdata.imageLoaded">(?i)\\(Users|AppData|Temp|ProgramData|Downloads)\\</field>
    <description>CVE-2026-91803: Foxit updater loaded a DLL from a user-writable directory - possible DLL search order hijack / privilege escalation</description>
    <mitre>
      <id>T1574.001</id>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_91803,dll_hijack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; no vendor fix, workaround, or affected-version list has been published. The following is defense-in-depth guidance pending a Foxit fix.

1. Immediate mitigations. Restrict write access to any directory from which the Foxit updater loads DLLs, and audit the updater's installation/execution directories for non-administrator write permissions — remove them. Where the environment pivots on the updater, consider disabling the automatic updater's privileged execution (service/scheduled task) and managing Foxit updates centrally via an administrative deployment tool instead of the built-in updater, thereby removing the privileged DLL-load step. Enforce application control (WDAC/AppLocker) to allow only signed, path-restricted DLLs, and enable DLL search-order hardening (e.g., SetDefaultDllDirectories-equivalent OS/App mitigations) and Sysmon ImageLoad (Event ID 7) auditing for the Foxit updater processes. Apply Microsoft's recommended mitigations for uncontrolled search path / DLL planting in user-writable locations.

2. Patch / upgrade steps. Monitor Foxit's official security advisories and product release notes for a fixed Foxit PDF Editor/Reader build addressing CVE-2026-91803. When a fixed version is published, prioritize upgrade on all endpoints running Foxit, verify the updater has been replaced, and re-validate the write-permission state of the updater's directories post-upgrade. There is currently no version to upgrade to; do not assume older or newer builds are safe.

3. Long-term hardening. Enforce least privilege so that standard users cannot write to any directory on a privileged process's DLL search path; build this into endpoint baselining. Prefer centrally managed software distribution for third-party applications to eliminate high-privilege self-updaters where feasible. Maintain DLL-planting-detection coverage (Sysmon EID 7 + the Sigma/Elastic/Splunk/Wazuh rules above), and include local privilege escalation via DLL hijack in purple-team exercises. Track CVE-2026-91803 in vulnerability management even without a patch so it is actioned the moment Foxit releases a fix.

References

• NVD — CVE-2026-91803: https://nvd.nist.gov/vuln/detail/CVE-2026-91803
• MITRE CWE-427 — Uncontrolled Search Path Element: https://cwe.mitre.org/data/definitions/427.html
• MITRE ATT&CK T1574.001 — Hijack Execution Flow: DLL Search Order Hijacking: https://attack.mitre.org/techniques/T1574/001/
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• Foxit Software Security Advisories (monitor for CVE-2026-91803 fix): https://www.foxit.com/support/security-bulletins.html

No threat actor campaign, exploit-in-the-wild activity, public proof-of-concept, or CISA KEV listing is associated with this CVE in the available data.