# CVE-2026-91800: Foxit PDF Editor privilege escalation in installer on macOS

Source: https://junglewise.ai/threats/cve-2026-91800-a-local-privilege-escalation-vulnerability-exists-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91800 · Severity: high · CVSS 8.8 · Published 2026-09-23

Foxit PDF Editor's macOS installer contains a local privilege escalation vulnerability that allows an attacker with local access to execute arbitrary commands with root privileges. An attacker could gain complete control of the system by exploiting insufficient validation of configuration values during software upgrades, potentially leading to data theft, malware installation, or system compromise.

Technologies: [Foxit PDF Editor](https://junglewise.ai/threats/technologies/pdf-editor). Vendors: [Foxit](https://junglewise.ai/threats/vendors/foxit).

## Quick answers

**Is CVE-2026-91800 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91800 being exploited in the wild.

**How severe is CVE-2026-91800?** High severity, with a CVSS score of 8.8, published 23 September 2026.

**Which products and versions are affected?** Foxit PDF Editor 2026.2.0 and earlier, 2025.3.0 and earlier, 2024.4.1 and earlier, 2023.3.0 and earlier, 14.0.7 and earlier, 13.2.6 and earlier.

**Is there a fix for CVE-2026-91800?** A patch was published on 2026-09-23: Foxit PDF Editor 2026.2.1 and 14.0.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91800 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-91800?** Check whether you run Foxit PDF Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the installer's upgrade mechanism due to insufficient validation of a user-modifiable configuration value that is processed with elevated privileges. A local, unauthenticated attacker can exploit this during high-privilege upgrade operations to execute arbitrary code as root. A patch is available in Foxit PDF Editor 2026.2.1 and later versions.

## Affected products

- Foxit PDF Editor 2026.2.0 and earlier, 2025.3.0 and earlier, 2024.4.1 and earlier, 2023.3.0 and earlier, 14.0.7 and earlier, 13.2.6 and earlier

## Timeline

- 2026-09-23: disclosed: CVE-2026-91800 published
- 2026-09-23: patched: Foxit PDF Editor 2026.2.1 and 14.0.8 released

## References

- [https://www.foxit.com/support/security-bulletins.html](https://www.foxit.com/support/security-bulletins.html)

## Related threats

- [Foxit PDF Editor use-after-free in JavaScript annotation handling](https://junglewise.ai/threats/cve-2026-91818-a-use-after-free-vulnerability-exists-in-foxit-pdf-editor-reader)
- [Foxit PDF Editor heap-based out-of-bounds read in JavaScript string handling](https://junglewise.ai/threats/cve-2026-91817-a-heap-based-out-of-bounds-read-vulnerability-exists-in-foxit-pdf)
- [Foxit PDF Editor use-after-free in annotation handling](https://junglewise.ai/threats/cve-2026-91816-a-use-after-free-vulnerability-exists-in-foxit-pdf-editor-reader)
- [Foxit PDF Editor/Reader out-of-bounds write in JPEG2000 decoding](https://junglewise.ai/threats/cve-2026-91815-foxit-pdf-editor-reader-does-not-perform-sufficient-verification)
- [Foxit PDF Editor and Reader signature validation bypass in incremental updates](https://junglewise.ai/threats/cve-2026-91814-a-signature-validation-vulnerability-exists-in-foxit-pdf-editor)