CVE-2026-3775: DLL Hijacking in Foxit PDF Editor/Reader Update Service
CVE-2026-3775 DLL hijacking in Foxit PDF Editor/Reader update service enables local privilege escalation to SYSTEM.
Foxit has patched CVE-2026-3775, a high-severity local privilege escalation vulnerability (CVSS 7.8) in its PDF Editor and Reader update service on Windows and macOS. The flaw stems from unsafe DLL search-order hijacking, allowing low-privileged users to plant malicious DLLs in writable directories that the update service loads with SYSTEM privileges. The vulnerability is particularly dangerous in multi-user environments like shared workstations and terminal servers, requiring no user interaction for exploitation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Foxit?
Get an email when a new story names Foxit, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2026-3775 demonstrates how improper DLL search order configuration can create serious privilege escalation vulnerabilities. The Foxit update service unsafely loads dynamic libraries from writable directories, allowing attackers with low-level access to plant malicious DLLs that execute with SYSTEM privileges. This vulnerability is particularly concerning in shared computing environments where multiple users access the same system, as it requires no user interaction to exploit. The flaw highlights the importance of secure coding practices and proper configuration management in software update mechanisms.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-3775