Foxit PDF Editor and Reader contain a race condition in the updater that permits a local attacker to replace the update package between download and extraction, because the system lacks proper file locking and integrity checks. This flaw allows the attacker to execute arbitrary code with elevated privileges and therefore gain full control of the affected system.

The vulnerability is active in Foxit PDF Editor and Foxit PDF Reader, both provided by Foxit Software Inc. All versions that utilize the vulnerable update mechanism without the published fix are affected; the exact version range is not listed in the CNA data.

The flaw carries a CVSS score of 8.8, indicating a high severity outcome for successful exploitation. The EPSS metric is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Because the trigger requires local access to the file system and the ability to influence the download‑to‑extract sequence, the attack vector is inferred to be local, likely requiring an authenticated user with write permissions to the update directory. If the local attacker can achieve this, they can obtain system‑level access on the compromised machine.