CVE-2026-3775 is a DLL hijacking vulnerability (CWE-427) in Foxit PDF Editor up to version 2025.3. The update service improperly loads DLLs from directories that can be written to by low-privileged users. An attacker with local access can exploit this by placing a malicious DLL in such a directory, which the update service loads with SYSTEM privileges, resulting in local privilege escalation and arbitrary code execution. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity. No official patch or vendor remediation guidance is currently available.

Successful exploitation allows a local attacker to escalate privileges to SYSTEM level and execute arbitrary code on the affected system. This compromises system integrity and confidentiality. There are no known exploits in the wild at this time.

No official patch or remediation guidance is currently provided by the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restricting local user write permissions on directories used by the update service may reduce risk, but this is not confirmed as a complete mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.