8.8

CVE-2025-13941

Medienbericht
A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions are assigned to resources used by the update service. A local attacker with low privileges could modify or replace these resources, which are later executed by the service, resulting in execution of arbitrary code with SYSTEM privileges.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Foxit ≫ Pdf Editor Version <= 13.2.1.23955
   Microsoft ≫ Windows Version-
Foxit ≫ Pdf Editor Version >= 14.0.0.33046 <= 14.0.1.33197
   Microsoft ≫ Windows Version-
Foxit ≫ Pdf Editor Version >= 2023.1.0.15510 <= 2023.3.0.23028
   Microsoft ≫ Windows Version-
Foxit ≫ Pdf Editor Version >= 2024.1.0.23997 <= 2024.4.1.27687
   Microsoft ≫ Windows Version-
Foxit ≫ Pdf Editor Version >= 2025.1.0.27937 <= 2025.2.1.33197
   Microsoft ≫ Windows Version-
Foxit ≫ Pdf Reader Version <= 2025.2.1.33197
   Microsoft ≫ Windows Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.01% 0.018
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2 6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
14984358-7092-470d-8f34-ade47a7658a2 8.8 2 6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.