CVE-2026-3775
Published: 01 April 2026
Summary
CVE-2026-3775 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Foxit Pdf Editor. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique DLL (T1574.001); ranked at the 16.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-3775 is a local privilege escalation vulnerability (CWE-427: Untrusted Search Path) in the update service of a Foxit application. When checking for updates, the service loads certain system libraries from a search path that includes directories writable by low-privileged users, without strictly restricting resolution to trusted system locations. This flaw has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A low-privileged local attacker can exploit this vulnerability by placing a malicious library in a user-writable directory on the search path. When the update service runs with SYSTEM privileges and resolves libraries, it loads the attacker's malicious library, enabling arbitrary code execution, local privilege escalation to SYSTEM level, and full compromise of the system.
Foxit's security bulletins at https://www.foxit.com/support/security-bulletins.html provide details on patches and mitigations for this vulnerability. Security practitioners should consult the advisory for version-specific remediation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17751
Vulnerability details
The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these libraries may be resolved and loaded…
more
from user‑writable locations, a local attacker can place a malicious library there and have it loaded with SYSTEM privileges, resulting in local privilege escalation and arbitrary code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Untrusted search path allows DLL Search Order Hijacking (T1038) via malicious library placement in writable directories; directly enables local privilege escalation (T1068) when loaded by SYSTEM process.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing this CVE by applying vendor patches that fix the untrusted library search path in the update service.
SI-7 mandates integrity checks for software and firmware, preventing the update service from loading and executing malicious libraries placed in user-writable search path directories.
CM-6 enforces secure baseline configuration settings that restrict the library search path used by the SYSTEM-privileged update service to trusted, non-writable system locations only.