This vulnerability in Foxit PDF Editor/Reader arises from a TOCTOU race condition in the update process. The update package is not adequately locked or validated for integrity between the time it is downloaded and the time it is extracted with high privileges. This gap allows a local attacker to replace the update package with malicious code, leading to arbitrary code execution with elevated privileges. The CVSS 3.1 score is 8.8, indicating high severity with local attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows local attackers to execute arbitrary code with elevated privileges on the affected system. This can lead to full system compromise, including confidentiality breaches, integrity violations, and denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should limit local access to trusted users and monitor for suspicious activity related to update processes.