The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable directories, allowing a local attacker to place malicious binaries with the same names and have them loaded or executed instead of the legitimate system files, resulting in local privilege escalation.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-3780
• https://www.foxit.com/support/security-bulletins.html