CVE-2026-57239: Foxit & Windows Local Privilege Escalation – HIGH Severity

Technical summary

CVE-2026-57239 is a privilege escalation vulnerability arising from improper handling of executable file execution. The affected applications—Foxit PDF Editor, Foxit PDF Reader, and Microsoft Windows—execute user-controllable files directly from contexts running at high privilege levels without adequate validation. This violates the principle of least privilege and creates a local privilege escalation pathway. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C) indicates low attack complexity, no privilege requirement for the attacker, and required user interaction. The impact scope crosses boundaries, affecting confidentiality and integrity with a score of 8.2 (HIGH).

Business impact

Successful exploitation allows attackers with local system access to gain administrative control, enabling data theft, system compromise, malware installation, and lateral movement within corporate networks. For organizations relying on Foxit PDF tools or Windows systems with mixed-privilege users, this creates a significant post-compromise risk—particularly in environments where users with standard accounts share systems with administrative functions. Remediation delays increase exposure to data exfiltration and persistent backdoor installation.

Affected systems

Foxit PDF Editor and Foxit PDF Reader are directly affected across supported versions until patched. Microsoft Windows systems hosting these applications are also in scope. The vulnerability requires local system access, making it most relevant to multi-user systems, shared workstations, and environments where standard users coexist with higher-privilege processes. Check vendor advisories for specific affected version ranges and Windows editions.

Exploitability

Exploitation requires local access and user interaction—an attacker cannot trigger this remotely. However, user interaction is not complex; a user simply opening a malicious PDF or invoking the application with a specially crafted file can initiate privilege escalation. Once the application executes the user-controlled file at high privilege, the attacker gains SYSTEM-level access. The low attack complexity and widespread use of PDF applications make this practical for insider threats and post-compromise scenarios.

Remediation

Apply security patches from Foxit and Microsoft immediately upon availability. Verify patch version numbers against official vendor advisories. Implement application whitelisting to restrict which executables can run from user-writable directories. Enforce principle of least privilege by running Foxit applications with standard user privileges where feasible. Disable unnecessary high-privilege process execution paths and monitor file execution from temporary and user directories.

Patch guidance

Monitor Foxit's official security advisories and Microsoft's patch Tuesday releases for CVE-2026-57239 fixes. Apply updates to both Foxit PDF Editor and Foxit PDF Reader across all deployed instances. Coordinate with your Microsoft patching schedule to address Windows components simultaneously. Test patches in a staging environment before enterprise rollout to verify compatibility with existing PDF workflows. Prioritize systems used to process untrusted or external PDF documents.

Detection guidance

Monitor process creation and file execution events from user-writable locations (Temp, Downloads, AppData). Look for high-privilege processes executing binaries from directories outside standard installation paths. Audit child processes spawned by Foxit applications, particularly unexpected executables. Implement behavioral analysis to detect unusual privilege escalation attempts or SYSTEM-level process creation following PDF application use. Review Windows Security logs and endpoint detection tools for anomalous execution chains.

Why prioritize this

This vulnerability merits immediate patching due to its HIGH severity, local privilege escalation impact, and low exploitation complexity. While remote exploitation is not possible, the widespread deployment of Foxit PDF tools and the common coexistence of standard and elevated-privilege users on Windows systems create substantial risk. Any attacker with local access—including supply-chain compromises, insider threats, or post-compromise lateral movement—can escalate to SYSTEM. The cross-system impact scope amplifies business disruption potential.

Risk score, explained

The CVSS 8.2 (HIGH) score reflects a local attack vector with no privilege requirement, low complexity, and scope change affecting confidentiality and integrity without availability impact. While user interaction is required, it is minimal and easily satisfied in practical scenarios. The ability to reach NT AUTHORITY\SYSTEM privileges justifies the elevated score. This is not a critical worm vector, but represents a severe local privilege escalation suitable for post-compromise scenarios and insider threats.

Frequently asked questions