Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2025-13941

Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Foxit

Description

A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions are assigned to resources used by the update service. A local attacker with low privileges could modify or replace these resources, which are later executed by the service, resulting in execution of arbitrary code with SYSTEM privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Foxit Software Inc. Foxit PDF Reader

Default version status: unaffected

  • Versions 2025.2.1 and earlieraffected
  • Versions 14.0.1 and earlieraffected
  • Versions 13.2.1 and earileraffected

Foxit Software Inc. Foxit PDF Editor

Default version status: unaffected

  • Versions 2025.2.1 and earlieraffected
  • Versions 14.0.1 and earlieraffected
  • Versions 13.2.1 and earileraffected

References