Foxit PDF Editor/Reader's signature-validation pop-up reports modified certified documents as valid

CVE-2026-18622 is a UI-misrepresentation flaw (CWE-451) in Foxit PDF Reader and Foxit PDF Editor on Windows and macOS. When a digitally signed or certified PDF has its signature fields abnormally modified — through changes to appearance properties, field coordinates, or outright field duplication — the application's signature-validation pop-up still reports the document as validly signed. This lets an attacker alter visible document content post-signature and present a forgery that Foxit's UI blesses as trustworthy. Affected versions include all Foxit PDF Reader and Editor builds prior to 2026.1.3 on both platforms, plus Editor legacy tracks prior to 14.0.6 and 13.2.6. The researchers — Enzo da Rosa Brum, Frederico Schardong, and Ricardo Felipe Custódio at Brazil's Federal University of Santa Catarina — build on the well-known 'shadow attack' lineage of PDF signature bypasses first cataloged at pdf-insecurity.org.

Foxit's own MEDIUM / 4.7 rating is honest and, if anything, generous. The CVSS vector AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N correctly captures that (a) the attack is delivered via a local file the victim must open, (b) complexity is high because the attacker must craft a specific manipulation that survives Foxit's partial validation logic, (c) there is no code execution — the impact is purely integrity (document trust), and (d) user interaction is required. No confidentiality or availability impact exists. This is a social-engineering amplifier for document fraud, not a gateway to system compromise.

Why this verdict

• No code execution: This is an integrity-only UI-misrepresentation bug. The worst outcome is document fraud — no shell, no privilege escalation, no data exfiltration. This caps the ceiling well below HIGH.
• High attack complexity (AC:H): The attacker must craft a PDF manipulation that specifically survives Foxit's partial signature validation logic. Not every shadow-attack variant works; version-specific testing is required.
• Minority viewer market share: Foxit holds roughly 14–25% of the PDF market. In enterprise environments with Adobe Acrobat site licenses or browser-default viewing, the reachable victim population shrinks further.
• Role multiplier: Foxit PDF Reader/Editor is a *desktop client application*. It does not occupy any high-value infrastructure role (not an IdP, hypervisor, domain controller, or network edge device). Even in document-signing workflows, server-side validation backends (DocuSign, Adobe Sign) are unaffected. The blast radius is one user, one document — no fleet-scale or domain-scale outcome is reachable through this CVE alone.
• User interaction dependency: The victim must (a) open the PDF in Foxit specifically, (b) inspect the signature validation UI, and (c) make a consequential decision based on it. Each step is a probabilistic filter that reduces real-world impact.

Why not higher?

There is no code execution, no confidentiality impact, and no availability impact. The attack cannot pivot to system compromise, lateral movement, or data exfiltration. The affected component is a desktop PDF viewer — it does not occupy a high-value infrastructure role whose compromise would cascade to fleet-scale impact. No floor-raising condition from the role multiplier applies.

Why not lower?

The integrity impact is genuinely High per CVSS — if a victim trusts the forged signature, the consequences in legal, financial, or regulatory document workflows can be severe. PDF signature trust is a meaningful security property in government and enterprise contexts, and Foxit is deployed in over 1,200 government and corporate offices worldwide. The academic pedigree of shadow attacks (26 of 28 PDF viewers vulnerable in the original research) suggests the manipulation techniques are well-understood and reproducible.

1. Enforce server-side signature validation for high-value document workflows — Route contracts, procurement approvals, and regulatory filings through a server-side validation service (Adobe Sign, DocuSign, or an internal ETSI-compliant validator) that does not rely on Foxit's client-side UI. This neutralizes the attack entirely. No specific SLA — this is a process control, not a patch.
2. Deploy Foxit 2026.1.3 / 14.0.6 / 13.2.6 through standard software update channels — No mitigation SLA applies for MEDIUM — go straight to the 365-day noisgate remediation SLA. Bundle with your next quarterly desktop software refresh. Use SCCM, Intune, or Foxit's enterprise admin console for deployment.
3. Educate document-signing stakeholders about cross-viewer validation — Advise users who rely on PDF digital signatures to cross-check signatures in a second viewer (Adobe Acrobat, or a command-line tool like pdfsig from poppler-utils) before making high-stakes decisions. This is a low-cost awareness measure.
4. Inventory Foxit installations across the fleet — Use your endpoint management platform (SCCM, Intune, Tanium, Qualys agent) to identify all Foxit PDF Reader and Editor installations and their versions. Prioritize patching for users in legal, finance, and procurement roles who handle signed documents.

Run on each Windows endpoint (or remotely via Invoke-Command) with standard user privileges. Example: powershell -ExecutionPolicy Bypass -File Check-CVE-2026-18622.ps1. Also works for macOS by checking the app bundle version manually — but the script targets Windows where Foxit is most commonly deployed.

#!/usr/bin/env powershell
# Check-CVE-2026-18622.ps1
# Checks whether installed Foxit PDF Reader or Editor is vulnerable to CVE-2026-18622
# No admin privileges required. Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$vulnerable = $false
$found = $false

# Define fixed versions per product track
$fixedVersions = @{
    '2026' = [version]'2026.1.3.0'
    '14'   = [version]'14.0.6.0'
    '13'   = [version]'13.2.6.0'
}

# Search common install locations and registry
$regPaths = @(
    'HKLM:\SOFTWARE\Foxit Software\Foxit PDF Reader',
    'HKLM:\SOFTWARE\Foxit Software\Foxit PDF Editor',
    'HKLM:\SOFTWARE\WOW6432Node\Foxit Software\Foxit PDF Reader',
    'HKLM:\SOFTWARE\WOW6432Node\Foxit Software\Foxit PDF Editor'
)

foreach ($rp in $regPaths) {
    $installPath = (Get-ItemProperty -Path $rp -Name 'InstallPath' -ErrorAction SilentlyContinue).InstallPath
    if (-not $installPath) { continue }
    
    $exes = @('FoxitPDFReader.exe','FoxitPDFEditor.exe','FoxitReader.exe','FoxitPhantomPDF.exe')
    foreach ($exe in $exes) {
        $fullPath = Join-Path $installPath $exe
        if (Test-Path $fullPath) {
            $found = $true
            $ver = (Get-Item $fullPath).VersionInfo.ProductVersion
            if (-not $ver) { continue }
            $parsedVer = [version]($ver -replace '[^0-9.]','')
            $majorTrack = $parsedVer.Major.ToString()
            
            if ($fixedVersions.ContainsKey($majorTrack)) {
                $fixed = $fixedVersions[$majorTrack]
                if ($parsedVer -lt $fixed) {
                    Write-Host "VULNERABLE - $exe version $ver (fixed in $fixed)" 
                    $vulnerable = $true
                } else {
                    Write-Host "PATCHED - $exe version $ver"
                }
            } else {
                # Unknown major version track - flag for review
                Write-Host "UNKNOWN - $exe version $ver (unrecognized version track $majorTrack)"
            }
        }
    }
}

if (-not $found) {
    Write-Host 'UNKNOWN - No Foxit PDF Reader or Editor installation detected'
    exit 2
} elseif ($vulnerable) {
    exit 1
} else {
    exit 0
}

Sources

1. Foxit Security Bulletin — CVE-2026-18622
2. CWE-451: UI Misrepresentation of Critical Information
3. PDF Shadow Attacks Research — pdf-insecurity.org
4. Frederico Schardong — Google Scholar
5. Foxit PDF Editor Market Share — 6sense
6. Foxit Patches Multiple Vulnerabilities in 2026.1.2 Update — CyberPress
7. FIRST EPSS API