Multiple vulnerabilities in Foxit PDF products
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR warns of multiple Foxit PDF Reader and Editor flaws enabling code execution and privilege escalation.
CERT-FR has published a security advisory documenting multiple vulnerabilities affecting Foxit PDF products. The affected products include Foxit PDF Reader (versions prior to 2026.2.1), Foxit PDF Editor (versions 13.x prior to 13.2.7, versions 14.x prior to 14.0.8, and versions prior to 2026.2.1). The vulnerabilities permit attackers to achieve arbitrary code execution, privilege escalation, and compromise the confidentiality and integrity of data. Foxit has released patched versions to address these issues. Defenders should prioritize patching affected Foxit installations, particularly those exposed to untrusted PDF content, as PDF readers are a common attack vector for code execution.
Mentioned in this report
Detection guidance
Foxit PDF Reader or Editor Spawning Script Interpreter or LOLBin
Foxit PDF Reader/Editor spawning a shell, script host or common LOLBin, which is typical of post-exploitation after a malicious PDF triggers code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Foxit PDF Reader or Editor Spawning Script Interpreter or LOLBin
id: 5947dff3-842d-50d6-b0b6-1c53982ec44e
status: experimental
description: Detects Foxit PDF Reader or Editor spawning command shells, script hosts
or download/execute LOLBins. PDF readers rarely launch these, so this pattern suggests
exploitation of a vulnerability (code execution) via a malicious PDF. Generalises
on the parent/child relation, not on any specific payload.
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1214
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \FoxitPDFReader.exe
- \FoxitReader.exe
- \FoxitPDFEditor.exe
- \FoxitPhantomPDF.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
- \wmic.exe
condition: selection_parent and selection_child
falsepositives:
- Foxit plugins or integrations (e.g. document management or signing add-ins) that
legitimately launch helper scripts
- Administrators using Foxit's JavaScript or Action Wizard features to run local batch
files
level: high
author: Vorant
Foxit PDF Process Dropping Executable or Script into Startup Folder
Foxit PDF Reader/Editor writing an executable or script file into a user or all-users Startup folder, indicating exploit-driven persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Foxit PDF Process Dropping Executable or Script into Startup Folder
id: a93a2d7f-f24b-55e4-9768-c0f617bf68fc
status: experimental
description: Detects Foxit PDF Reader or Editor creating executable or script files
in a Windows Startup folder. A PDF reader should not write such files there, so
this suggests post-exploitation persistence after a malicious PDF exploits a vulnerability.
tags:
- attack.execution
- attack.t1203
- attack.persistence
- attack.t1547.001
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \FoxitPDFReader.exe
- \FoxitReader.exe
- \FoxitPDFEditor.exe
- \FoxitPhantomPDF.exe
TargetFilename|contains: \Start Menu\Programs\Startup\
TargetFilename|endswith:
- .exe
- .dll
- .bat
- .cmd
- .vbs
- .js
- .ps1
- .lnk
condition: selection
falsepositives:
- Users saving a shortcut (.lnk) to the Startup folder from within Foxit, which is
very uncommon
level: high
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1214
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1214
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs