Microsoft, Adobe, Apple, and Foxit vulnerabilities

1. Executive summary

Cisco Talos disclosed seven vulnerabilities across Adobe Photoshop, Apple macOS, Foxit Reader, and Microsoft Windows, all of which the vendors have patched. The two Foxit Reader flaws (CVE-2026-57256, CVSS 7.8; CVE-2026-91799, CVSS 7.8) are the most directly exploitable by an external party: both are triggered by a malicious PDF, and CVE-2026-91799 leads to arbitrary code execution. The Microsoft Windows driver flaws (CVE-2026-58613, CVE-2026-80093, both CVSS 7.8) require a local attacker running a dedicated application but yield privilege escalation to kernel level. None of the seven CVEs is in CISA KEV and all carry an EPSS of 0%, so there is no evidence of exploitation in the wild; the risk is from unpatched endpoints and the difficulty of detecting PDF-borne and driver-level exploitation, not from active campaigns.

2. Regulatory framing

No article from the regulatory reference is engaged by the Apple macOS CoreWLAN information disclosure (TALOS-2026-2376) beyond the general patching obligation already covered above.

3. Technical analysis & attack chain

All seven vulnerabilities are patched by their respective vendors. There is no evidence of exploitation in the wild: none of the CVEs is in CISA KEV and all have an EPSS of 0%. The attack chains below describe the mechanism as disclosed by Talos, not observed activity.

The two Foxit Reader flaws are the most operationally relevant because they are triggered by a file an attacker can deliver by email or web download, with no prior access to the target host.

1. An attacker crafts a PDF containing malicious JavaScript.
2. The victim opens the PDF in Foxit Reader 2026.1.1.36485.
3. For CVE-2026-57256, the JavaScript checkbox CBF_Widget functionality processes a malformed file and executes attacker-controlled code.
4. For CVE-2026-91799, the JavaScript triggers a use-after-free in the way Foxit Reader handles an Array object, causing memory corruption that can be shaped into arbitrary code execution.
5. Code execution runs in the context of the Foxit Reader process, giving the attacker the user's privileges on the endpoint.

The Microsoft Windows driver flaws require a local attacker already able to run code on the host, so they are post-compromise escalation primitives rather than initial access vectors.

1. The attacker obtains a foothold on the Windows host (method not described in the source).
2. For CVE-2026-58613 and CVE-2026-80093, the attacker runs a dedicated application that issues a crafted sequence of Cloud Filter API calls against the Windows Cloud Files Mini Filter Driver (versions 10.0.26100.8457 and 10.0.26100.8655).
3. CVE-2026-58613 is a use-after-free that leads to privilege escalation; CVE-2026-80093 is a type confusion that an attacker can trigger with the same API-call pattern.
4. For CVE-2026-50475 and CVE-2026-49177, the attacker sends a crafted I/O request packet (IRP) to the NETIO.sys or tcpip.sys driver. CVE-2026-50475 causes disclosure of sensitive information via an out-of-bounds pointer offset; CVE-2026-49177 causes an arbitrary out-of-bounds read that can lead to information disclosure or a denial-of-service condition.

The Adobe Photoshop flaw (CVE-2026-48388, CVSS 8.6) is a privilege escalation in the Installation functionality of Photoshop_Set-Up.exe version 2.11.0.30. An attacker replaces files with a specially crafted malformed file during installation to escalate privileges. This requires the attacker to control or influence the installer's file environment, so it is most relevant to shared or repackaged deployment scenarios rather than a standard user install.

The Apple macOS CoreWLAN information disclosure (TALOS-2026-2376) affects macOS 26.3.1 (25D2128). An attacker calls a sequence of APIs to trigger the flaw. Talos gives no CVE identifier for this item and no further mechanism detail; treat the impact as information disclosure only.

Discrepancy note: the verified reference data records CVE-2026-50475 as CWE-126 (buffer over-read) and CVE-2026-49177 as CWE-125 (out-of-bounds read). The Talos text describes CVE-2026-50475 as an out-of-bounds pointer offset and CVE-2026-49177 as an out-of-bounds read. Both classifications describe the same underlying memory-safety flaw; the verified CWE values are authoritative.

Confidence caveat: the technical detail in this section rests on a single source, the Cisco Talos disclosure blog. The related ANSSI and BSI advisories (corpus-1 through corpus-4) corroborate that Foxit, Adobe, and Apple macOS products have multiple vulnerabilities in the same period, but they do not independently confirm the specific mechanisms, versions, or CVE mappings above. Verify version strings and CVE-to-product mappings against the vendor advisories before acting.

4. Mitigation & containment

P1 (within 24 hours)

• Patch Foxit Reader to the current vendor release on all endpoints. The affected version is 2026.1.1.36485. This is the highest priority because CVE-2026-57256 and CVE-2026-91799 are both triggered by a PDF and CVE-2026-91799 yields arbitrary code execution.
• Patch Windows endpoints carrying the affected Cloud Files Mini Filter Driver versions 10.0.26100.8457 and 10.0.26100.8655. CVE-2026-58613 and CVE-2026-80093 are privilege escalation flaws in that driver.
• If patching cannot be completed immediately, restrict PDF opening to a sandboxed viewer or disable JavaScript execution in Foxit Reader for untrusted documents.

P2 (within 72 hours)

• Patch the Windows NETIO.sys and tcpip.sys drivers for CVE-2026-50475 and CVE-2026-49177. These are information disclosure and denial-of-service flaws; they are lower priority than the privilege escalation and code execution items but still require the OS-level patch.
• Patch Adobe Photoshop installations using Photoshop_Set-Up.exe version 2.11.0.30 for CVE-2026-48388. Prioritise shared or repackaged deployment images where an attacker could influence the installer file environment.
• Patch macOS to a version later than 26.3.1 (25D2128) for the CoreWLAN information disclosure. Talos gives no CVE for this item; track it by the Talos ID TALOS-2026-2376 and the macOS version.

P3 (within 7 days)

• Confirm that endpoint detection and response coverage extends to driver-level activity on Windows hosts, specifically Cloud Filter API call sequences and IRP handling by NETIO.sys and tcpip.sys.
• Review whether Foxit Reader is required on the estate at all. Where it is not, remove it rather than patch it.
• Deploy the Snort rule sets referenced by Talos for network detection of exploitation attempts against these vulnerabilities.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe vulnerability mechanisms and affected versions but provide no file hashes, network indicators, registry keys, or file paths. The affected version strings are not indicators of compromise; they are patch targets and are covered in §4.

Behavioural indicators

These behaviours are derived from the vulnerability mechanisms described by Talos. They are not observed activity and will produce false positives in normal operation. Tune before alerting.

6. Detection

Insufficient indicators to author detection rules.

The sources provide no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text, or hard-coded values. The only artefacts are CVE identifiers, Talos IDs, product names, and version strings, none of which are threat artefacts. A rule built on those would detect reporting about the vulnerabilities, not exploitation of them. No YARA or Sigma rule is emitted.

CVE assessment

7 referenced CVEs

7. Sources

• Cisco Talos, "Microsoft, Adobe, Apple, and Foxit vulnerabilities", https://blog.talosintelligence.com/microsoft-adobe-apple-and-foxit-vulnerabilities/, 2026-10-07.
• ANSSI France CERT, "Multiples vulnérabilités dans les produits FoxIT", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1214/, 2026-09-23.
• ANSSI France CERT, "Multiples vulnérabilités dans les produits Foxit", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0845/, 2026-07-08.
• BSI Germany, "[NEU] [hoch] Adobe Acrobat und Acrobat Reader: Mehrere Schwachstellen", https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3249.
• BSI Germany, "[UPDATE] [kritisch] Apple macOS: Mehrere Schwachstellen", https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2475.

8. Adverse Trace position

Adverse Trace assesses this as a moderate-priority patching item, not an active threat. None of the seven CVEs is in CISA KEV and all have an EPSS of 0%, so there is no evidence of exploitation. The severity is driven by the Foxit Reader code execution flaws (CVE-2026-57256 and CVE-2026-91799, both CVSS 7.8) and the Windows Cloud Files Mini Filter Driver privilege escalation flaws (CVE-2026-58613 and CVE-2026-80093, both CVSS 7.8), which together give an attacker both an initial access vector and a kernel-level escalation path if a host is left unpatched. The technical detail rests on a single source, the Cisco Talos blog; the ANSSI and BSI advisories corroborate that these product families have multiple vulnerabilities but do not independently confirm the mechanisms or CVE mappings, so verify version strings against vendor advisories before enforcement. We will track vendor patch releases for Foxit Reader, the Windows Cloud Files Mini Filter Driver, NETIO.sys, tcpip.sys, Photoshop, and macOS, and will issue a follow-up if any of these CVEs is added to CISA KEV or if exploitation is reported. Clients should confirm patch status for the affected versions listed in §4 and report any suspected exploitation through their normal incident channel.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.