CVE-2026-91813 is a time-of-check to time-of-use race condition in the Foxit PDF Reader and Editor updater on Windows. An update package can be replaced between download and privileged extraction. NVD scores it High (8.8). Update to Reader 2026.2.1 or Editor 2026.2.1 or 14.0.8.
What's affected
Foxit's bulletin of 23 September 2026 lists the same affected builds for all of its updater issues: Reader 2026.2.0.39747 and earlier, and Editor 2026.2.0.39747 and earlier on 2026.x, along with the 2025, 2024, 2023, 14.x and 13.x lines named in the bulletin, on Windows. The fixed releases are Reader 2026.2.1 and Editor 2026.2.1 or 14.0.8.
The weakness is CWE-367, time-of-check time-of-use race condition. The vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Foxit rates it Important at 8.8, which matches the record, so the sources agree.
How to check if you're exposed
Check Help, then About in the product and compare the build number against the fixed releases. Foxit's Check for Update is in the same menu.
On shared machines such as terminal servers, labs and kiosks, many local users can reach the temporary folders an updater uses. Those machines are where a local escalation matters most, so check them first.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Update Foxit PDF Reader to 2026.2.1, or Foxit PDF Editor to 2026.2.1 or 14.0.8.
- Prioritise multi-user Windows machines.
- Remove unused Foxit installations.
- Keep software deployment tooling in charge of updates so ordinary users are not running privileged updaters themselves.
Why it matters
A race condition of this kind happens when a program checks a file, then uses it later, and a window opens between the two steps. The bulletin says insufficient file locking and integrity validation let a local attacker swap the downloaded package before the privileged extraction step. The updater then trusts a file it never re-verified.
The cure is to lock the file or verify it again right before use, from a location ordinary users cannot write to. The attacker needs a local login, which limits remote use, but a local to SYSTEM jump is high value after any initial foothold. The KEV flag in the record is false and the bulletin reports no exploitation.
Quick check
How is this different from the other two Foxit updater issues?
This one is a race between download and extraction. The others are unsafe DLL loading and weak certificate validation. All are fixed in the same releases.
Do I need to be an administrator to exploit it?
The vector says low privileges are required, so an ordinary local account is enough.
Sources
Last reviewed: 18 October 2026.
