A local privilege escalation vulnerability in Foxit PDF Editor and Reader allows attackers to achieve arbitrary code execution with SYSTEM privileges by placing malicious libraries in user-writable directories.

The application's update service performs insecure library loading, specifically via DLL hijacking (CWE-427), by searching directories writable by low-privileged users. This allows a local authenticated user to substitute legitimate libraries with malicious ones that execute with elevated SYSTEM privileges.

Successful exploitation of this vulnerability results in a full compromise of the host system, as the attacker gains SYSTEM-level access. This allows for total control over the application environment, potentially leading to data theft, installation of persistent backdoors, and lateral movement within the network. Given the CVSS score of 7.8, this represents a high-severity risk that demands immediate attention to prevent local privilege escalation.

Immediate Action: Monitor the official Foxit security bulletin page for the release of a patched version and apply the update to all affected installations immediately upon availability.

Proactive Monitoring: Review system logs for unusual process execution patterns or the loading of unsigned libraries, particularly within the application's update service directories.

Compensating Controls: Restrict write permissions on application directories and system paths to prevent unauthorized users from placing malicious files in locations where they might be loaded by higher-privilege services.

Public Exploit Available: No

This vulnerability presents a significant risk to endpoint integrity due to the potential for privilege escalation to the SYSTEM level. Organizations should prioritize updating all Foxit PDF Editor and Reader instances as soon as the vendor provides a corrective patch. In the interim, ensure that standard user accounts are restricted from modifying files or directories associated with the application update service to limit the attack surface.