A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor and Reader. The daemon inherits insecure permission settings that allow ordinary users to modify its configuration file, enabling the execution of arbitrary scripts with elevated system privileges. If an attacker can write to this file, they can run code as a privileged user, potentially compromising the entire system.

Foxit Software Inc. products Foxit PDF Editor and Foxit PDF Reader are affected. No specific version range is listed in the CNA data, so all versions release prior to any official patch are potentially vulnerable.

The CVSS score of 8.8 indicates a severe exploit with high impact. The EPSS score is less than 1%, suggesting that current exploitation attempts are unlikely but still possible. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires local access to modify a configuration file, a local attacker with user privileges can trigger the exploit to gain higher privileges. Proper mitigation requires ensuring the updater’s configuration file permissions are restricted and applying any vendor patches once available.