A flaw in Foxit PDF Editor/Reader’s update mechanism allows a man‑in‑the‑middle attacker to bypass certificate validation and the integrity checks that normally protect the update process. The attacker can then supply a malicious update package which, when installed, grants execution of arbitrary code with system privileges on the affected machine. The weakness, categorized as improper certificate validation, is a classic example of improper verification of an issuer’s digital signature.

Foxit Software Inc. releases are impacted – specifically Foxit PDF Editor and Foxit PDF Reader. No specific versions are listed in the CNA data, indicating that all current releases may be vulnerable unless a vendor patch is applied.

The CVSS v3 score of 7.9 signifies a high‑severity vulnerability, while the EPSS score of less than 1 % suggests low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be able to intercept the update traffic, such as through a compromised network or proxy device. Once the malicious update is accepted, the attacker achieves local privilege escalation and can run code with full system permissions.