A vulnerability exists in the updater component of Foxit PDF Editor and Reader that allows an attacker with local access to place a malicious DLL in a user‑writable directory. Because the updater loads DLLs from that directory during high‑privilege operations, the malicious DLL can execute with elevated privileges, effectively granting the attacker full administrative access to the affected machine.

Foxit Software Inc.'s Foxit PDF Editor and Foxit PDF Reader are affected. No specific product versions are listed in the CNA data, so all currently installed instances are potentially vulnerable until a patch is applied.

The flaw scores a high CVSS value of 8.8, indicating extensive impact if exploited. The EPSS score is below 1%, suggesting the likelihood of exploitation is very low at present, and the vulnerability is not in CISA’s KEV catalog. Nonetheless, because the attack vector requires local user access, any user who can write to the update directory can trigger execution, making the risk real for environments with untrusted local users.