Local Privilege Escalation in Foxit PDF Reader Update Service
CVE-2025-13941

8.8HIGH

Key Information:

Vendor

Foxit Inc.

Status
Foxit
Foxit PDF Editor
Vendor
CVE Published:
19 December 2025

What is CVE-2025-13941?

A vulnerability exists in the Foxit PDF Reader/Editor Update Service that permits local privilege escalation. The issue arises during the installation of plugins where improper file system permissions are set for resources utilized by the update service. This flaw allows a local attacker with minimal privileges to manipulate or replace these resources, leading to the potential execution of arbitrary code with elevated SYSTEM privileges. This can expose systems to significant security risks.

Affected Version(s)

Foxit PDF Editor Windows Versions 2025.2.1 and earlier

Foxit PDF Editor Windows Versions 14.0.1 and earlier

Foxit PDF Editor Windows Versions 13.2.1 and eariler

References

https://www.foxit.com/support/security-bulletins.html

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-13941 : Local Privilege Escalation in Foxit PDF Reader Update Service