CVE-2026-3780CWE-426

Foxit PDF Editor/Reader Installer Uncontrolled Search Path Privilege Escalation

High · published April 1, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
6.6
In the wild
Unconfirmed
What it is

The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable directories, allowing a local attacker to place malicious binaries with the same names and have them loaded or executed instead of the legitimate system files, resulting in local privilege escalation.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00174 · 6.6th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2026-04-01T01:40Z
EPSS history
Timeline
  • 01 APR 01:40Z
    Foxit PDF Editor/Reader Installer Uncontrolled Search Path Privilege Escalation
    cvelistv5