CVE-2026-91812

Executive Summary

CVE-2026-91812 is a certificate validation weakness (CWE-295) in the update mechanism of Foxit PDF Editor and Foxit PDF Reader that permits a man-in-the-middle attacker to bypass both TLS certificate validation and the integrity check applied to downloaded update packages. A successful attacker positioned on the network path can cause the application to accept a tampered update and execute it with system privileges. The vulnerability is unpatched as of this report, no public proof-of-concept or exploit code exists, and exploitation requires user interaction (update action) plus an adjacent network foothold, yielding a CVSS base score of 7.9 (High).

Technical Analysis

The affected component is the software update mechanism of Foxit PDF Editor/Reader. Per the NVD description, the flaw allows an attacker in a man-in-the-middle position to "bypass certificate validation and package integrity checks." Operationally this means two independent defensive controls are defeated:

1. Transport trust (certificate validation): The update client does not correctly validate the TLS certificate presented by the update server. A certificate that fails a legitimate PKI validation path — self-signed, expired, wrong hostname, or issued by an untrusted CA — is accepted. This is the canonical manifestation of CWE-295 (Improper Certificate Validation). With this control broken, the attacker does not need to compromise the real update infrastructure; they only need to control the traffic path (ARP spoofing, rogue Wi-Fi, DNS poisoning, BGP hijack, transparent proxy, or a compromised upstream router) and terminate the TLS session with their own certificate.

2. Payload trust (package integrity): Independently, the update package's integrity verification is also bypassable. The description does not disclose whether this is a signature check, a cryptographic hash comparison, or a manifest validation, and no algorithm, key format, or file name is specified. What can be stated factually is that the integrity control that would normally reject a modified update payload is insufficient, so a substituted or modified package is accepted for processing.

The combination is what elevates this from an interception issue to a code execution issue. Either control alone would contain the impact: broken TLS validation without an integrity bypass still leaves the package signature as a backstop, and an integrity weakness without TLS breakage is normally only reachable by an attacker who already controls the update server. Together, they remove the entire trust chain from the update channel.

Attack surface: the update client's egress path to its update endpoint, specifically the network-facing download-and-verify routine. The CVSS vector indicates S:C (Scope Changed), meaning the vulnerable component and the impacted component are in different security authorities — consistent with an update process that crosses from a network-facing trust context into the local system context, ultimately executing with system privileges.

CVSS 3.1 decomposition: AV:A (Adjacent) reflects the need for logical or physical adjacency to the traffic path rather than internet-wide reachability; AC:H (High) reflects the preconditions — the attacker must win a race, intercept, and serve a malicious payload against a specific client; PR:N (no privileges required); UI:R (the user must initiate or approve an update check that the attacker intercepts); S:C, C:H/I:H/A:H (full compromise of confidentiality, integrity, and availability within the impacted scope). The score of 7.9 is High severity — mitigated by attack complexity and user interaction, not by any weakness in the impact.

Note on data limitations: the CVE record provides no affected version ranges, no package identifiers, and no patch reference. Statements below about specific versions, build numbers, or vendor hotfixes cannot be made without fabrication and are therefore omitted.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-295 plus integrity-check bypass in an auto-update path) and the NVD description. No specific function names, endpoints, or file paths are asserted because the source data does not provide them.

1. Reconnaissance / target identification. The attacker identifies hosts running Foxit PDF Editor or Foxit PDF Reader on a network they can influence — a shared corporate LAN, a public Wi-Fi network, a branch office, or a downstream segment reachable via a routing or DNS position. Reconnaissance at the vulnerability-class level consists of identifying which hosts generate traffic to Foxit update infrastructure, since the flaw lives in that channel.

2. Positioning for man-in-the-middle. The attacker establishes a position on the update traffic path: ARP spoofing on the local segment, a rogue access point with the same SSID, DNS cache poisoning to redirect the update hostname, or a compromised network device. Because certificate validation in the update client is broken, no valid certificate for the genuine update hostname is required — a self-signed or otherwise invalid certificate is sufficient to stand up an impersonated update endpoint.

3. Triggering the flaw and delivering the payload. The client performs an update check (scheduled, on launch, or user-initiated), which satisfies the UI:R requirement. The intercepted session is answered by the attacker's endpoint. The client fails to properly validate the presented certificate, accepts the session, downloads the attacker-supplied package, and — because the integrity check is also bypassable — treats the modified package as authentic. Payload execution is at the vulnerability-class level: the accepted package is processed by the update mechanism and results in code execution with system privileges, as stated in the NVD description. The exact packaging, signing scheme, or delivery routine is not disclosed and is not speculated here.

4. Post-exploitation impact. Code executes in the security context of the update process — described as system privileges — giving the attacker full integrity, confidentiality, and availability impact on the host: persistence, credential access from local stores, lateral movement, or deployment of additional tooling. Because the vector is Scope:Changed, the compromise extends beyond the update component into the host operating system context.

Realistic variations: an attacker on a hostile Wi-Fi network waiting for a mobile or traveling user to launch Foxit; a malicious insider or compromised switch in a corporate VLAN; or an ISP-level or transit-level adversary conducting targeted interception against a specific organization. The High attack complexity reflects that these preconditions must align, not that the technique is exotic.

Impact Assessment

Business impact centers on endpoint compromise via a trusted software channel. Affected systems are workstations and servers where Foxit PDF Editor or Foxit PDF Reader is installed and permitted to reach its update infrastructure. The blast radius is bounded by attacker positioning (adjacent network) and by user interaction, but the resulting access level is the strongest single factor: successful exploitation yields code execution with system privileges, and the Scope:Changed rating means the impact escapes the application sandbox into the host.

CVSS subscores: Confidentiality High, Integrity High, Availability High, all within the changed scope. Practically, a compromised endpoint grants access to documents the user can read (relevant in legal, financial, and engineering environments where PDF workflows are prevalent), credentials cached or stored on the host, and a foothold for lateral movement into internal networks. Because the integrity control failed, the update channel itself is untrustworthy for the affected population, which undermines a control that security teams rely on for remediation — this raises incident response cost, since responders cannot assume updates delivered during the exposure window were legitimate.

Organizational risk factors that increase exposure: large populations of roaming laptops, guest or BYOD network access, environments that cannot enforce TLS inspection or egress filtering, and a history of unpatched Foxit installations. The absence of CISA KEV listing, an EPSS score, exploit code, or a Nuclei template means there is currently no evidence of active exploitation at scale — but the vulnerability class (update-channel MITM) is a known, well-understood technique, and the lack of a tracking template should not be read as low likelihood of weaponization once technical details circulate.

Detection Guidance

Sigma Rule

title: Foxit PDF Update Process Spawning Suspicious Child Process
id: 8e4a1c72-3f5b-4d9e-9b21-6c2f7a0d5b14
status: experimental
description: Detects a Foxit update-related process spawning script interpreters or shells, which may indicate successful exploitation of CVE-2026-91812 via a tampered update package.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91812
author: Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1557
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\FoxitPDFEditorUpdate.exe'
      - '\FoxitReaderUpdate.exe'
      - '\FoxitUpdater.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Foxit installers invoking helper scripts during an update
level: high

YARA Rule

rule CVE_2026_91812_Foxit_Update_Impersonation
{
    meta:
        description = "Detects indicators of a substituted Foxit update package or MITM update infrastructure impersonation related to CVE-2026-91812"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91812"
        cve = "CVE-2026-91812"

    strings:
        $foxit = "Foxit" ascii wide nocase
        $upd1 = "FoxitUpdater" ascii wide
        $upd2 = "FoxitReaderUpdate" ascii wide
        $upd3 = "FoxitPDFEditorUpdate" ascii wide
        $sign = "This program cannot be run in DOS mode" ascii
        $pe = { 4D 5A }

    condition:
        $pe at 0 and
        filesize < 50MB and
        $foxit and
        any of ($upd*)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91812 Possible Foxit Update Channel Interception - Untrusted TLS Certificate on Update Flow"; flow:established,to_server; tls.store; byte_test:1,!&,0x80,5; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-91812; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91812; metadata:service tls; sid:202691812; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91812 Foxit Update Package Download Over Self-Signed or Invalid TLS Session"; flow:established,to_server; content:"GET"; http_method; content:"update"; http_uri; nocase; tls.store; threshold:type limit, track by_src, count 3, seconds 60; classtype:attempted-user; reference:cve,2026-91812; sid:202691813; rev:1;)

Note: these rules are heuristic — they flag update-shaped traffic where TLS metadata suggests an untrusted or abnormal certificate, which is the transport-layer symptom of the vulnerability. They rely on TLS logging/inspection being enabled; without visibility into the handshake, only the download-shape rule applies.

Elastic Detection

sequence by host.hostname with maxspan=5m
  [process where process.parent.name : ("FoxitUpdater.exe", "FoxitReaderUpdate.exe", "FoxitPDFEditorUpdate.exe") and event.action == "start"]
  [process where process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe") and event.action == "start"]

Splunk SPL Query

index=main (source="WinEventLog:Security" OR source="WinEventLog:Sysmon")
(EventCode=1 OR EventCode=4688)
| eval parent=coalesce(ParentImage, ParentProcessName)
| eval child=coalesce(Image, NewProcessName)
| where (like(parent, "%Foxit%Update%.exe") OR like(parent, "%FoxitUpdater.exe%"))
        AND (like(child, "%cmd.exe") OR like(child, "%powershell.exe%") OR like(child, "%wscript.exe%")
             OR like(child, "%cscript.exe%") OR like(child, "%mshta.exe%") OR like(child, "%rundll32.exe%"))
| stats count min(_time) as first_seen max(_time) as last_seen values(child) as children by host parent
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="foxit,cve-2026-91812,mitm_update">
  <rule id="202691812" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">(?i)Foxit.*Update.*\.exe$</field>
    <field name="win.eventdata.image">(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32)\.exe$</field>
    <description>CVE-2026-91812: Foxit update process spawned suspicious child process - possible tampered update execution</description>
    <mitre>
      <id>T1557</id>
      <id>T1059</id>
    </mitre>
    <group>execution,</group>
  </rule>

  <rule id="202691813" level="10">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">(?i)Foxit.*Update.*\.exe$</field>
    <description>CVE-2026-91812: Foxit update process executed - correlate with TLS anomaly on update channel</description>
    <group>process_creation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix is referenced, and no workarounds are documented. The following are risk-reduction measures, not fixes for the root cause.

1. Immediate mitigations

   • Block or tightly restrict outbound traffic from Foxit update processes to the internet at the host firewall or egress proxy, so the vulnerable channel is unusable. If updates are required, force them through an authenticated, inspected proxy rather than direct egress.
   • Where TLS inspection exists, ensure update traffic is actually inspected and that invalid, self-signed, or wrong-hostname certificates are rejected at the proxy or via certificate pinning at the network layer — the client's own validation cannot be trusted.
   • Enforce network controls that reduce MITM feasibility: wired 802.1X, dynamic ARP inspection, DHCP snooping, DNSSEC where available, and DNS-over-HTTPS/TLS to hardened resolvers for endpoints.
   • Reduce reliance on the built-in updater: deploy Foxit updates through a managed software distribution system (SCCM, Intune, Jamf, or an internal repository) with hash verification performed by the management platform, and disable or block the self-update path.
   • Heighten monitoring on the update process (see Detection Guidance) — because integrity checks failed during the exposure window, any unexplained Foxit binary change should be treated as a potential compromise.

2. Patch/upgrade steps

   • No patched version is identified in any tracked source at this time. Monitor the Foxit security advisory page and the NVD entry for CVE-2026-91812 for a fixed release.
   • When a fix ships, upgrade every installed instance of Foxit PDF Editor and Foxit PDF Reader (both are named as affected products) to the fixed version, then verify the installed build by comparing cryptographic hashes against the vendor-published values where provided.
   • Because the update channel itself is untrusted for affected versions, obtain fixed installers over a verified, independent channel rather than through the application's own updater.

3. Long-term hardening

   • Establish a software-update integrity policy: updates must be delivered over a channel the endpoint can validate and verified against a signature or hash anchored in a trusted store, with the management platform performing independent verification.
   • Inventory and track all PDF reader/editor installations; unmanaged or shadow installations are the populations most exposed to an update-channel MITM.
   • Add update-process behavior to detection baselines: any update helper spawning a script interpreter, writing to system directories, or registering persistence is high signal.
   • Include update-channel MITM in threat modeling for roaming and branch users, and require VPN or zero-trust network access for endpoints on untrusted networks.
   • Where full technical details of the bypass are eventually published, re-evaluate whether any compensating control (network filtering, proxy inspection) is genuinely effective against the specific bypass, rather than assumed effective.

References

• NVD — CVE-2026-91812: https://nvd.nist.gov/vuln/detail/CVE-2026-91812
• CWE-295 — Improper Certificate Validation: https://cwe.mitre.org/data/definitions/295.html
• MITRE ATT&CK T1557 — Adversary-in-the-Middle: https://attack.mitre.org/techniques/T1557/
• FIRST EPSS (score not yet published for this CVE at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91812 is not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign note: no evidence of exploitation in the wild, no public PoC, no Nuclei template, and no KEV listing are associated with CVE-2026-91812 in the data provided. The attack pattern is consistent with established update-channel interception tradecraft used by espionage and commodity intrusion sets, but no actor attribution can be made from the available information.