A recently unveiled vulnerability in Foxit PDF Reader has raised significant concerns among cybersecurity experts. Tracked under the identifier CVE-2026-57239, this flaw poses a severe security risk, allowing a local attacker—one who already possesses code execution capabilities—to escalate their privileges to NT AUTHORITY\SYSTEM. The implications of such an exploit are far-reaching, potentially granting the attacker full control over the affected Windows host.
The vulnerability specifically affects installations of Foxit PDF Reader prior to version 2026.2 and arises due to an insecure updater workflow initiated by a user-writable file located within the ProgramData directory. This issue caught the attention of security researcher Luke Paris, who conducted a thorough examination of Foxit’s update components using tools like Process Monitor and reverse-engineering methods. By delving into the updater’s architecture, Paris was able to identify the underlying flaws that could be manipulated by malicious actors.
To successfully execute an attack utilizing this vulnerability, the adversary must already have code execution privileges as a low-privileged Windows user. This circumstance categorizes the flaw as a local privilege escalation vulnerability rather than a remote code execution flaw. Despite the local nature of the attack, its consequences could be dire. If successfully exploited, an attacker could engage in a variety of nefarious activities, including credential theft, manipulation of security tools, maintaining a persistent foothold in the system, and preparing for lateral movement across networks.
The heart of the problem lies with the FoxitPDFReaderUpdateService.exe service, which runs with elevated NT AUTHORITY\SYSTEM privileges. This service is responsible for monitoring files in locations such as C:\ProgramData\Foxit\Software\Foxit\PDF\Reader\FoxitData.txt—a directory that standard users can write to without issue. This accessibility allows an attacker to craft a malicious update request that prompts the service to execute FoxitPDFReaderUpdater.exe from the Attacker’s AppData directory.
Although Foxit’s updater includes mechanisms that check the executable names and signing information in an effort to thwart direct replacement of the updater binary, researchers discovered a potential sideloading method. Specifically, by inducing the updater to display a graphical update prompt and interacting with a link in that interface, an attacker can facilitate the loading of a maliciously crafted winspool.drv file from the updater’s working directory.
Crucially, a Windows .drv file acts as a portable executable module that can run executable code via its DllMain entry point. As such, when executed in the context of the SYSTEM-launched updater, this malicious module could allow complete system control. The proof-of-concept attack chain relies on the existence of a writable control file, predictable service behavior, and an unsecured module-loading condition.
Moreover, the payload embedded in the FoxitData.txt file employs AES encryption with a hard-coded key, necessitating UTF-16 little-endian encoding. This technical specification enables attackers to formulate requests that can trigger this privileged updater flow effectively. Foxit Software has acknowledged the issue and has issued a patch for the vulnerability in version 2026.2, reinforcing the importance of keeping software up to date.
In light of this vulnerability, organizations are urged to take immediate action by updating their installations of Foxit PDF Reader. They should also perform diligent reviews of endpoints for any unauthorized .dll or .drv files located under %APPDATA%\Foxit\Software\Continuous\Addon\Foxit\PDF\Reader. Furthermore, security teams are advised to monitor any write activities to the FoxitData.txt file by processes that are not signed by FOXIT SOFTWARE INC., as well as track Windows process creation (as noted by Event ID 4688) and any unusual token activity.
Implementing application control policies, such as through AppLocker or Windows Defender Application Control, can further mitigate risks related to malicious module loading and help reduce the chances of exploitation via DLL sideloading. As cybersecurity threats continue to evolve, proactive measures remain essential in safeguarding systems against vulnerabilities like CVE-2026-57239.