The Foxit PDF Editor update service improperly loads system libraries from search paths that include user-writable directories. This DLL hijacking vulnerability (CWE-427) enables a local attacker to insert a malicious library into a writable directory, which the update service loads with SYSTEM privileges. This leads to local privilege escalation and arbitrary code execution. The vulnerability affects versions 2025.3 and earlier. The CVSS 3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A local attacker with write access to certain directories can escalate privileges to SYSTEM level by exploiting the DLL hijacking flaw in the update service. This can lead to full system compromise through arbitrary code execution with the highest privileges. The impact affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write permissions on directories included in the update service's DLL search path to prevent unprivileged users from placing malicious libraries. Monitor for vendor updates regarding an official patch or workaround.