Threat Intelligence Report: CVE-2026-91813

Executive Summary

CVE-2026-91813 is a race condition (CWE-367, Time-of-Check Time-of-Use) in the update mechanism of Foxit PDF Editor and Foxit Reader. The vulnerability arises from insufficient file locking and integrity validation during the update process, allowing a locally positioned attacker to swap a legitimate update package between the download phase and the high-privilege extraction phase. Successful exploitation enables arbitrary code execution with elevated privileges, posing a critical risk to enterprises deploying Foxit products on endpoints where low-privileged users have local access. No public PoC or patch currently exists, and the CVE has not been added to CISA KEV.

Technical Analysis

CVE-2026-91813 resides in the update subsystem shared by Foxit PDF Editor and Foxit Reader. The root cause is a classic Time-of-Check Time-of-Use (TOCTOU) condition, classified as CWE-367. The update workflow — as described by the NVD — performs two distinct operations: (1) an update package is downloaded to a local staging location, and (2) that package is subsequently extracted under high privilege (e.g., by a service or privileged helper process).

Between these two steps, the downloaded package is not adequately protected by file locking, and its integrity is not sufficiently validated before extraction. This opens a window in which a local attacker can replace the legitimate update package with an attacker-controlled file. Because the extraction step executes under high privilege, the substituted content is processed in a privileged context, and the attacker's payload is ultimately executed with elevated rights.

CVSS 3.1 vector components confirm the threat model:

• AV:L (Local) — the attacker must already possess a foothold on the target host.
• AC:L (Low) — no special conditions beyond the race window are required.
• PR:L (Low) — attacker holds only low-privileged local access.
• UI:N (None) — no user interaction is required once the race is triggered.
• S:C (Scope: Changed) — the vulnerable update component's compromise impacts resources beyond its own security scope (privilege boundary is crossed).
• C:H / I:H / A:H — full loss of confidentiality, integrity, and availability in the impacted context.

The mechanism is a privilege-escalation primitive, not a remote code-execution flaw. The attack surface is the local filesystem path where update packages are staged and the privileged process that consumes them.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-91813. The attack chain below is inferred strictly from the vulnerability class (CWE-367 TOCTOU in an update mechanism) and the NVD description. No specific function names, class names, file paths, or API parameters are asserted beyond those stated in the advisory.

1. Reconnaissance / target identification. The attacker establishes a low-privileged local session on a workstation or server running an affected Foxit PDF Editor or Foxit Reader build. The attacker identifies that the Foxit update mechanism is configured to check for, download, and apply updates — or waits for a scheduled update cycle to initiate a download.

2. Triggering the flaw class. During an update cycle, Foxit downloads an update package to a local staging location. Because the package is not held under a sufficient file lock and its integrity is not validated before extraction, a TOCTOU window exists between download and extraction. The attacker monitors the staging location and, within that window, replaces the downloaded package with an attacker-crafted file.

3. Payload / execution at the vulnerability-class level. The privileged update-extraction process then operates on the substituted package. Since the extraction runs with elevated privileges and the substituted content is not integrity-checked, attacker-controlled content is processed in the high-privilege context — resulting in execution of arbitrary code with elevated rights (per the NVD description).

4. Post-exploitation impact. With elevated privileges obtained, the attacker can perform actions restricted to the privileged account: modify system components, disable or tamper with security tooling, establish persistence, harvest credentials, or move laterally within the environment.

The critical precondition remains an existing low-privileged local foothold and a reachable, writable staging location — this is a local privilege-escalation scenario, not a remote one.

Impact Assessment

CVE-2026-91813 carries a CVSS 3.1 base score of 8.8 (High). The Scope:Changed rating elevates severity because compromise of the update component affects resources outside its own security boundary — specifically, the integrity and control of the underlying operating system account context.

Business impact:

• Privilege escalation on endpoints. Any host running an affected Foxit product where a low-privileged user (or an attacker who has obtained such access) can reach the update staging area is at risk. This includes standard enterprise workstations, VDI instances, and shared multi-user systems.
• Blast radius. The flaw is per-host and requires local access, so it does not yield worm-like propagation by itself. However, in environments where Foxit is broadly deployed — a common configuration in document-heavy workflows (legal, finance, government, healthcare) — a single compromised low-privileged account can be escalated to administrative control on each affected endpoint, broadening lateral movement options.
• Confidentiality/Integrity/Availability. All three are rated High within the impacted scope, meaning an escalated attacker can read sensitive data, tamper with system or user content, and disrupt availability.
• No KEV listing and no known exploitation in the wild at this time, so immediate emergency response is not signaled — but the absence of a patch (0/4 confidence) makes proactive mitigation essential.

Detection Guidance

Detection must focus on anomalous file operations in update staging locations and on unexpected child processes spawned by the Foxit update service. Because specific paths are not disclosed, rules below use behavior- and process-relationship-based logic and require environment-specific tuning.

Sigma Rule

title: Potential TOCTOU Update Package Replacement - Foxit PDF Update Mechanism
id: 8f4b2c1e-9a7d-4e3b-b6c2-1d5e7f9a0c31
status: experimental
description: Detects suspicious file replacement activity in Foxit update staging directories followed by privileged updater execution, indicative of CVE-2026-91813 (CWE-367 TOCTOU).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91813
author: Threat Intelligence
date: 2026-01-01
tags:
  - attack.privilege_escalation
  - attack.t1574
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Foxit'
      - 'Foxit'
  selection_update_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.msi'
      - '.msp'
      - '.zip'
  selection_action:
    EventType: 'Create'
  condition: selection_path and selection_update_ext and selection_action
fields:
  - TargetFilename
  - Image
  - User
falsepositives:
  - Legitimate Foxit updates writing to staging directories
  - IT-driven software deployment
level: medium

YARA Rule

rule CVE_2026_91813_Foxit_Update_Package_Anomaly
{
    meta:
        description = "Detects suspicious update package content staged for the Foxit update mechanism potentially associated with CVE-2026-91813 TOCTOU abuse"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91813"
        date = "2026-01-01"
        severity = "high"

    strings:
        $foxit1 = "Foxit" ascii wide nocase
        $foxit2 = "FoxitPDF" ascii wide nocase
        $upd1   = "update" ascii wide nocase
        $upd2   = ".msp" ascii wide nocase
        $upd3   = ".msi" ascii wide nocase
        $ps1    = "powershell" ascii wide nocase
        $cmd    = "cmd.exe" ascii wide nocase
        $tmp1   = "\\Temp\\" ascii wide nocase
        $tmp2   = "\\AppData\\Local\\Temp" ascii wide nocase

    condition:
        filesize < 50MB and
        (
            (any of ($foxit*)) and (any of ($upd*)) and
            (any of ($ps1, $cmd))
        ) or
        (
            (any of ($upd*)) and (any of ($tmp*)) and (any of ($ps1, $cmd))
        )
}

Suricata IDS Rule

Network detection is a secondary control for this local TOCTOU flaw, but outbound retrieval of update packages and any post-exploitation callback can be monitored.

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91813 Possible Foxit Update Package Retrieval"; flow:established,to_server; http.host; content:"foxit"; nocase; http.uri; content:"update"; nocase; http.uri; content:".msp"; nocase; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91813; sid:202691813; rev:1;)

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91813 Foxit Update Package Download (msi)"; flow:established,to_server; http.host; content:"foxit"; nocase; http.uri; content:".msi"; nocase; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91813; sid:202691814; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ file where file.path : ("*\\Foxit*", "*Foxit*") and
      file.extension : ("exe", "msi", "msp", "zip") and
      event.action : "creation" ]
  [ process where process.parent.name : ("*Foxit*", "*Updater*", "*Update*") and
      process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
                      "mshta.exe", "rundll32.exe", "regsvr32.exe") ]

Splunk SPL Query

index=endpoint OR index=sysmon
(EventCode=11 OR EventID=11)
TargetFilename="*Foxit*"
(TargetFilename="*.exe" OR TargetFilename="*.msi" OR TargetFilename="*.msp" OR TargetFilename="*.zip")
| eval suspicious_path=if(match(TargetFilename, "(?i)\\\\Temp\\\\|\\\\AppData\\\\Local\\\\Temp"), 1, 0)
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as files values(User) as users by ComputerName, Image
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="windows,sysmon,foxit,">
  <rule id="2026918" level="10">
    <if_sid>61613</if_sid>
    <field name="win.eventdata.targetFilename">\.(exe|msi|msp|zip)$</field>
    <field name="win.eventdata.targetFilename">(?i)Foxit</field>
    <description>CVE-2026-91813: Suspicious update package written to Foxit staging path - possible TOCTOU package replacement</description>
    <mitre>
      <id>T1574</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>

  <rule id="2026919" level="12">
    <if_sid>61613</if_sid>
    <field name="win.eventdata.targetFilename">(?i)Foxit.*\.(msp|msi)$</field>
    <field name="win.eventdata.image">(?i)(cmd\.exe|powershell\.exe|wscript\.exe|mshta\.exe)</field>
    <description>CVE-2026-91813: Foxit update package created by scripting interpreter - possible exploitation of update TOCTOU race</description>
    <mitre>
      <id>T1574</id>
      <id>T1059</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence, vendor fix, workaround, or affected-version data is available from any tracked source. No CISA KEV listing exists. The following guidance is risk-reduction, not remediation.

1. Immediate mitigations

• Restrict local write access to update staging and installation directories so that low-privileged users cannot create or replace files there. Apply least-privilege ACLs on any Foxit update paths identified in your environment.
• Where the update mechanism permits it, disable automatic/silent updates and instead distribute updates through a controlled, integrity-verified software deployment pipeline (signed packages, internal repository).
• Enforce application allowlisting so that only signed, approved binaries execute in the context of the Foxit updater; block interpreter processes (scripting hosts) from being spawned by the update component.
• Increase monitoring fidelity on Foxit updater process relationships and on writes to staging directories (see Detection Guidance).

2. Patch / upgrade steps

• Monitor the Foxit security advisories and the NVD entry for CVE-2026-91813 continuously for a fixed release. No vendor fix is currently documented.
• Establish a subscription to Foxit's security notification channel and to CISA/NVD alerts so a fix can be staged immediately upon release.
• Once a patched version is published, validate the fix addresses the TOCTOU/integrity validation issue and roll it out via the controlled deployment pipeline above.

3. Long-term hardening

• Require cryptographically signed update packages and mandatory signature/integrity verification prior to any privileged extraction — this is the durable fix class for CWE-367 in updaters.
• Treat every software updater as a privileged attack surface: perform threat modeling and secure-design review of download→validate→extract→execute workflows across the software portfolio.
• Segment and monitor multi-user endpoints; assume local low-privileged access is obtainable and design defenses so that no user-writable location feeds a privileged process.
• Maintain behavior-based detection (process lineage, file staging anomalies) rather than signature-only detection, given the absence of public IOCs for this CVE.

References

• NVD — CVE-2026-91813: https://nvd.nist.gov/vuln/detail/CVE-2026-91813
• MITRE CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: https://cwe.mitre.org/data/definitions/367.html
• MITRE ATT&CK T1574 — Hijack Execution Flow: https://attack.mitre.org/techniques/T1574/
• FIRST EPSS — (no score published): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — (CVE-2026-91813 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-91813 at the time of writing. No public proof-of-concept, exploit code, or Nuclei template is available.