A high-severity local privilege escalation vulnerability in the Foxit PDF Editor installer for macOS allows low-privileged attackers to gain full root control of the system.

The vulnerability, categorized as CWE-732, arises from insufficient validation of user-modifiable configuration values during the high-privilege installation or upgrade process. A local attacker with low privileges can manipulate these values to achieve arbitrary command execution with root-level permissions.

The ability for a local user to escalate privileges to root represents a critical security failure, as it bypasses standard operating system access controls. Successful exploitation could lead to full system compromise, including the theft of sensitive data, the installation of persistent backdoors, or complete operational disruption. Given the CVSS score of 8.8, this flaw poses a significant risk to the integrity and confidentiality of any workstation where the software is deployed.

Immediate Action: Administrators should monitor the official Foxit security bulletins for the release of a patched version and apply the update across all macOS endpoints immediately upon availability.

Proactive Monitoring: Security teams should monitor system logs for unusual installer activity or unexpected processes spawning with root-level privileges during maintenance windows.

Compensating Controls: Restrict local user permissions where possible and ensure that software installation processes are performed by authorized administrators rather than standard users to limit the attack surface.

Public Exploit Available: No

This vulnerability represents a severe threat to macOS environments utilizing Foxit PDF Editor. Organizations must prioritize the identification of affected systems and prepare for an urgent deployment of the forthcoming vendor patch. Until the patch is applied, ensure that standard users are not granted unnecessary administrative rights on local machines to mitigate the risk of local escalation.