CVE-2026-91798CWE-732

CVE-2026-91798

High · published September 23, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
0.9
In the wild
Unconfirmed
What it is

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00102 · 0.9th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-09-23T12:17Z
References (1)
https://www.foxit.com/support/security-bulletins.html · 14984358-7092-470d-8f34-ade47a7658a2
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 23 SEP 07:50Z
    Foxit PDF Editor/Reader Updater Privilege Escalation
    cvelistv5