Potheeswaran 
A newly disclosed local privilege escalation vulnerability in Foxit PDF Reader, now tracked as CVE-2026-57239, lets an unprivileged Windows user obtain NT AUTHORITY\SYSTEM control by abusing the software’s own update mechanism.
The bug requires an attacker to already have some form of code execution on the target machine, making it a post-compromise escalation path rather than a remote attack vector, but the simplicity of the chain has drawn attention across the security community.
The vulnerability chain starts with the Foxit updater loading winspool.drv, a driver-style PE file, from a user-writable folder without validating where it comes from, which opens the door to DLL-style sideloading.
Foxit PDF Reader Flaw
Researcher Luke Paris found that a separate service, FoxitPDFReaderUpdateService.exe, runs constantly as SYSTEM and monitors a file called FoxitData.txt inside a writable ProgramData directory; when that file is modified, the SYSTEM-level service launches the updater executable directly.
By writing an AES-encrypted, UTF-16LE-encoded command block into that file and dropping a malicious driver file alongside the updater binary, a standard user account can trick the SYSTEM service into executing attacker-controlled code, completing the escalation from ordinary user to full system control.
Getting from raw sideload primitive to a working exploit chain took Paris weeks, partly because Foxit patched the original DLL sideload technique just three days after he found it, forcing him to hunt for a second sideloading path through the updater’s GUI dialog elements.
He eventually released a fully automated Rust-based proof of concept along with YARA detection rules on GitHub, giving defenders a way to hunt for both the dropper and loader components of the attack chain.
The flaw affects Foxit PDF Reader builds prior to version 2026.2, with the researcher’s testing conducted against version 2026.1. Foxit has since assigned the CVE and shipped a fix in the 2026.2 release, though as of publication, no confirmed in-the-wild exploitation has been reported.
This is not Foxit’s first brush with updater-related privilege escalation; Cisco Talos disclosed a similar improper certificate validation issue in the Foxit Reader updater back in 2024, and a related uncontrolled search path vulnerability was tracked separately as CVE-2025-9330, suggesting the update service has been a recurring weak point.
Mitigation
Security teams managing Foxit deployments should prioritize the following actions:
- Update Foxit PDF Reader to version 2026.2 or later, checking the updater folder for rogue DLL or DRV files before applying the patch.
- Monitor for processes other than those signed by Foxit Software writing to the FoxitData.txt file in ProgramData.
- Deploy AppLocker or similar application allow-listing tools to restrict which modules can load into trusted executables.
- Hunt for .dll and .drv artifacts in MFT timelines within the AppData Foxit updater folder, correlated with process creation and token impersonation event logs.
- Apply the published YARA rules to detect both the dropper and loader components associated with the exploit chain.
Organizations running Foxit PDF Reader in enterprise environments, particularly those where users routinely open untrusted documents, should treat this disclosure as a reminder that update services with SYSTEM privileges remain an attractive target for local privilege escalation research.
About the Author
