The vulnerability CVE-2026-3780 in Foxit PDF Reader arises from the installer running with elevated privileges while resolving system executables and DLLs via untrusted search paths. These paths can include directories writable by local users, enabling an attacker to substitute malicious binaries named identically to expected system files. When the installer loads these malicious binaries instead of the legitimate ones, it leads to local privilege escalation. The affected versions are 2025.3 and earlier. The CVSS 3.1 base score is 7.3, indicating high severity with local attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows a local attacker to escalate privileges by causing the installer to execute malicious binaries in place of legitimate system files. This compromises system confidentiality, integrity, and availability at a high severity level. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write permissions on directories included in the installer's search path to trusted users only. Avoid running the installer in untrusted environments or with unnecessary elevated privileges.