# Multiple vulnerabilities in Foxit PDF products

Published: 2026-09-23 · Severity: routine
Canonical: https://vorant.io/reports/aa7670af-6e52-55b4-81c5-39f8f712ca40/multiple-vulnerabilities-in-foxit-pdf-products

> CERT-FR warns of multiple Foxit PDF Reader and Editor flaws enabling code execution and privilege escalation.

CERT-FR has published a security advisory documenting multiple vulnerabilities affecting Foxit PDF products. The affected products include Foxit PDF Reader (versions prior to 2026.2.1), Foxit PDF Editor (versions 13.x prior to 13.2.7, versions 14.x prior to 14.0.8, and versions prior to 2026.2.1). The vulnerabilities permit attackers to achieve arbitrary code execution, privilege escalation, and compromise the confidentiality and integrity of data. Foxit has released patched versions to address these issues. Defenders should prioritize patching affected Foxit installations, particularly those exposed to untrusted PDF content, as PDF readers are a common attack vector for code execution.

## Mentioned in this report

- Vulnerabilities: CVE-2026-91788, CVE-2026-91789, CVE-2026-91790, CVE-2026-91791, CVE-2026-91792, CVE-2026-91793, CVE-2026-91794, CVE-2026-91795, CVE-2026-91796, CVE-2026-91797, CVE-2026-91798, CVE-2026-91799, CVE-2026-91800, CVE-2026-91801, CVE-2026-91802, CVE-2026-91803, CVE-2026-91804, CVE-2026-91805, CVE-2026-91806, CVE-2026-91807, CVE-2026-91808, CVE-2026-91809, CVE-2026-91810, CVE-2026-91811, CVE-2026-91812, CVE-2026-91813, CVE-2026-91814, CVE-2026-91815, CVE-2026-91816, CVE-2026-91817, CVE-2026-91818

## Detection guidance (public sample)

### Foxit PDF Reader or Editor Spawning Script Interpreter or LOLBin

ATT&CK: T1203

Foxit PDF Reader/Editor spawning a shell, script host or common LOLBin, which is typical of post-exploitation after a malicious PDF triggers code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Foxit PDF Reader or Editor Spawning Script Interpreter or LOLBin
id: 5947dff3-842d-50d6-b0b6-1c53982ec44e
status: experimental
description: Detects Foxit PDF Reader or Editor spawning command shells, script hosts
  or download/execute LOLBins. PDF readers rarely launch these, so this pattern suggests
  exploitation of a vulnerability (code execution) via a malicious PDF. Generalises
  on the parent/child relation, not on any specific payload.
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1214
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \FoxitPDFReader.exe
    - \FoxitReader.exe
    - \FoxitPDFEditor.exe
    - \FoxitPhantomPDF.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
    - \wmic.exe
  condition: selection_parent and selection_child
falsepositives:
- Foxit plugins or integrations (e.g. document management or signing add-ins) that
  legitimately launch helper scripts
- Administrators using Foxit's JavaScript or Action Wizard features to run local batch
  files
level: high
author: Vorant
```

### Foxit PDF Process Dropping Executable or Script into Startup Folder

ATT&CK: T1203

Foxit PDF Reader/Editor writing an executable or script file into a user or all-users Startup folder, indicating exploit-driven persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Foxit PDF Process Dropping Executable or Script into Startup Folder
id: a93a2d7f-f24b-55e4-9768-c0f617bf68fc
status: experimental
description: Detects Foxit PDF Reader or Editor creating executable or script files
  in a Windows Startup folder. A PDF reader should not write such files there, so
  this suggests post-exploitation persistence after a malicious PDF exploits a vulnerability.
tags:
- attack.execution
- attack.t1203
- attack.persistence
- attack.t1547.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \FoxitPDFReader.exe
    - \FoxitReader.exe
    - \FoxitPDFEditor.exe
    - \FoxitPhantomPDF.exe
    TargetFilename|contains: \Start Menu\Programs\Startup\
    TargetFilename|endswith:
    - .exe
    - .dll
    - .bat
    - .cmd
    - .vbs
    - .js
    - .ps1
    - .lnk
  condition: selection
falsepositives:
- Users saving a shortcut (.lnk) to the Startup folder from within Foxit, which is
  very uncommon
level: high
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1214
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1214

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/aa7670af-6e52-55b4-81c5-39f8f712ca40/multiple-vulnerabilities-in-foxit-pdf-products.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup