CVE-2026-91803 is a local privilege escalation in the updater of Foxit PDF Reader and Foxit PDF Editor on Windows. It loads DLLs from a user-writable directory during privileged operations. NVD scores it High (8.8). Update to Reader 2026.2.1 or Editor 2026.2.1 or 14.0.8.
What's affected
Foxit's security bulletin of 23 September 2026 lists Foxit PDF Reader 2026.2.0.39747 and earlier as affected, and Foxit PDF Editor 2026.2.0.39747 and earlier on the 2026.x line, plus several older lines: 2025.3.0.35737, 2024.4.1.27687, 2023.3.0.23028, 14.0.7.33751 and 13.2.6.24111 and earlier. The platform is Windows. The fixed releases are Reader 2026.2.1 and Editor 2026.2.1 or 14.0.8.
The weakness is CWE-427, uncontrolled search path element. The vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Foxit rates it Important with a score of 8.8, matching the record.
The bulletin covers several updater issues. Two others, CVE-2026-91812 and CVE-2026-91813, are described in their own posts.
How to check if you're exposed
In Foxit PDF Reader or Editor, choose Help, then About, and read the version. Compare it with the list above. You can also run Check for Update from the same menu.
On managed Windows fleets, inventory installed Foxit products with your endpoint tool. The affected list reaches back several years, so older installs that stopped updating are likely to be in range.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Update to Foxit PDF Reader 2026.2.1 or Foxit PDF Editor 2026.2.1 or 14.0.8, using Check for Update or the download links in the bulletin.
- Push the update through your software deployment tool for machines where users do not have rights to do it.
- Remove unused Foxit installs rather than leaving them to age.
- Check the install folder permissions, since the bulletin says the problem is a user-writable directory used by a privileged process.
Why it matters
Windows programs that run with high privilege and look for DLLs in a folder an ordinary user can write to are a long-standing source of privilege escalation. If the updater loads a library by name from such a folder, a user who can place a file there gets their code run with the updater's rights.
The fix is to load only from trusted locations. The attacker needs a local account, which keeps the flaw from being a remote risk, but on shared workstations a local to admin step is exactly what attackers want. The record's KEV flag is false and the bulletin does not say it is exploited.
Quick check
Is this remotely exploitable?
No. The vector is local and needs a low-privilege account on the machine.
Which release fixes it?
Foxit PDF Reader 2026.2.1, and Foxit PDF Editor 2026.2.1 or 14.0.8.
Sources
Last reviewed: 18 October 2026.
