CVE-2026-57239: Public PoC Exploits Foxit PDF Reader Vulnerability for SYSTEM Privileges
Do Son 
- CVE: CVE-2026-57239
- CVSS: 8.2 (High · CVSSv3)
- Product: Foxit Software Inc. Foxit PDF Editor
- Affected: Versions 2026.1.1 and earlier, Versions 14.0.4 and earlier, Versions 13.2.4 and earlier
- Impact: Foxit PDF Editor/Reader Local Privilege Escalation
- Status: No confirmed exploitation yet
- EPSS: 0.1% (30-day)
- Action: Update Foxit PDF Reader to version 2026.2 or later.
TL;DR
A security researcher has published full details and proof-of-concept code for a Foxit PDF Reader vulnerability. Tracked as CVE-2026-57239, the flaw lets a local, unprivileged user gain NT AUTHORITY\SYSTEM rights. Exploitation needs prior code execution on the machine, so this is a local privilege escalation, not a remote attack.
Why it matters
SYSTEM is the highest privilege level on Windows. An attacker who reaches it controls the whole machine. Foxit‘s PDF tools are widely used across enterprises, which widens the potential impact.
Researcher Luke Paris disclosed the issue on the Paradoxis blog and released working code on GitHub. Because both the write-up and the PoC are public, the barrier to abuse has dropped. So far, no one has confirmed exploitation in the wild.
How the attack works
The chain abuses Foxit’s update components. First, the updater loads a driver file, winspool.drv, from a writable folder without proper checks. That gap allows DLL-style sideloading, which runs attacker code inside the updater.
Meanwhile, a separate update service runs as SYSTEM and watches a file in a user-writable ProgramData folder. When that file changes, the service launches the updater with SYSTEM rights. By combining the sideload with this trigger, a normal user can run code as SYSTEM. The researcher describes the mechanism only, and this report does not repeat the exploit steps.
Affected versions
According to the researcher, builds before 2026.2 are affected. The testing referenced Foxit PDF Reader version 2026.1. Foxit later assigned CVE-2026-57239 and shipped a fix in the 2026.2 release.
Patch and mitigation steps
Update Foxit PDF Reader to version 2026.2 or later. Before updating, check the updater folder for rogue DLL or DRV files. Tools like AppLocker can restrict which modules load into which programs. Application allow-listing adds another layer against sideloading.
Given the public PoC, admins should treat patching as urgent. You can read the researcher’s full technical write-up of the Foxit PDF Reader vulnerability and review the published proof-of-concept on GitHub.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
