CVE-2026-3775: foxit software inc. foxit pdf editor Uncontrolled Search Path Element

Vulnerability summary

CVE-2026-3775 is a high (CVSS 7.8) Uncontrolled Search Path Element vulnerability in foxit software inc. foxit pdf editor. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.2% of scored vulnerabilities.

Timeline

1. 01-04-2026
   PublishedVulnerability first disclosed.
2. 02-04-2026
   Last modifiedVulnerability information updated.

Description

The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these libraries may be resolved and loaded from user‑writable locations, a local attacker can place a malicious library there and have it loaded with SYSTEM privileges, resulting in local privilege escalation and arbitrary code execution.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.