# CVE-2026-91798: Foxit PDF Editor and Reader privilege escalation in update daemon

Source: https://junglewise.ai/threats/cve-2026-91798-a-local-privilege-escalation-vulnerability-exists-in-the-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91798 · Severity: high · CVSS 8.8 · Published 2026-09-23

Foxit PDF Editor and Reader are document viewing and editing tools widely used in enterprise environments. An insecure permission configuration in the update daemon allows unprivileged local users to modify configuration files and execute arbitrary scripts with elevated system privileges, creating a clear path for privilege escalation attacks.

Technologies: [Foxit PDF Editor](https://junglewise.ai/threats/technologies/pdf-editor), [Foxit PDF Reader](https://junglewise.ai/threats/technologies/pdf-reader). Vendors: [Foxit](https://junglewise.ai/threats/vendors/foxit).

## Quick answers

**Is CVE-2026-91798 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91798 being exploited in the wild.

**How severe is CVE-2026-91798?** High severity, with a CVSS score of 8.8, published 23 September 2026.

**Which products and versions are affected?** Foxit PDF Editor 2026.2.0.39747, 2025.3.0.35737 and earlier, 2024.4.1.27687 and earlier, 2023.3.0.23028 and earlier, 14.0.7.33751 and earlier, 13.2.6.24111 and earlier; Foxit PDF Reader 2026.2.0.39747 and earlier.

**Is there a fix for CVE-2026-91798?** A patch was published on 2026-09-23: Fixed in Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1/14.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91798 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-91798?** Check whether you run Foxit PDF Editor or Foxit PDF Reader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local privilege escalation vulnerability exists in the update daemon due to improper file permissions on its configuration file, allowing unprivileged users to modify it. An authenticated local attacker can exploit this to achieve arbitrary script execution with higher privileges. The vulnerability affects multiple versions of both Foxit PDF Editor and Reader on Windows and has been patched in version 2026.2.1 and later.

## Affected products

- Foxit PDF Reader 2026.2.0.39747 and earlier
- Foxit PDF Editor 2026.2.0.39747, 2025.3.0.35737 and earlier, 2024.4.1.27687 and earlier, 2023.3.0.23028 and earlier, 14.0.7.33751 and earlier, 13.2.6.24111 and earlier

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1/14.0.8

## References

- [https://www.foxit.com/support/security-bulletins.html](https://www.foxit.com/support/security-bulletins.html)

## Related threats

- [Foxit PDF Editor use-after-free in JavaScript annotation handling](https://junglewise.ai/threats/cve-2026-91818-a-use-after-free-vulnerability-exists-in-foxit-pdf-editor-reader)
- [Foxit PDF Editor heap-based out-of-bounds read in JavaScript string handling](https://junglewise.ai/threats/cve-2026-91817-a-heap-based-out-of-bounds-read-vulnerability-exists-in-foxit-pdf)
- [Foxit PDF Editor use-after-free in annotation handling](https://junglewise.ai/threats/cve-2026-91816-a-use-after-free-vulnerability-exists-in-foxit-pdf-editor-reader)
- [Foxit PDF Editor/Reader out-of-bounds write in JPEG2000 decoding](https://junglewise.ai/threats/cve-2026-91815-foxit-pdf-editor-reader-does-not-perform-sufficient-verification)
- [Foxit PDF Editor and Reader signature validation bypass in incremental updates](https://junglewise.ai/threats/cve-2026-91814-a-signature-validation-vulnerability-exists-in-foxit-pdf-editor)