Read the docs
TI-2026-03268 Aliases CVE-2026-3778GHSA-hfjq-v5wc-856q

Stack exhaustion caused by cyclic references in Foxit PDF Editor/Reader

Priority LOW 26CWE-674Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-674.

Summary

The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00107 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Foxit Software Inc.Foxit PDF Editorup to 2025.3; up to 14.0.2; up to 13.2.2—No fix listedCNA
Foxit Software Inc.Foxit PDF Readerup to 2025.3—No fix listedCNA
  • Foxit PDF Editor VendorFoxit Software Inc. Affected up to 2025.3; up to 14.0.2; up to 13.2.2 Fixed in — No fix listed CNA
  • Foxit PDF Reader VendorFoxit Software Inc. Affected up to 2025.3 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*up to 13.2.2.24014; 14.0.0.33046 – 14.0.2.33402; 2023.1.0.15510 – 2023.3.0.23028; 2024.1.0.23997 – 2024.4.1.27687; 2025.1.0.27937 – 2025.3.0.35737VulnerableFoxit
cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*up to 2025.3.0.35737VulnerableFoxit
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*up to 13.2.2.63349; 14.0.0.68868 – 14.0.2.69164; 2023.1.0.55583 – 2023.3.0.63083; 2024.1.0.63682 – 2024.4.1.66479; 2025.1.0.66692 – 2025.3.0.69570VulnerableFoxit
cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*up to 2025.3.0.69570VulnerableFoxit
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
  • cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:* Versions up to 13.2.2.24014; 14.0.0.33046 – 14.0.2.33402; 2023.1.0.15510 – 2023.3.0.23028; 2024.1.0.23997 – 2024.4.1.27687; 2025.1.0.27937 – 2025.3.0.35737 Vulnerable ·Foxit
  • cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:* Versions up to 2025.3.0.35737 Vulnerable ·Foxit
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:* Versions up to 13.2.2.63349; 14.0.0.68868 – 14.0.2.69164; 2023.1.0.55583 – 2023.3.0.63083; 2024.1.0.63682 – 2024.4.1.66479; 2025.1.0.66692 – 2025.3.0.69570 Vulnerable ·Foxit
  • cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:* Versions up to 2025.3.0.69570 Vulnerable ·Foxit
  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3778
  2. 2026-10-03 Alias added: GHSA-hfjq-v5wc-856q

References

Advisory 1

  • TI-2011-04633 Foxit PDF Reader < 4.3.1.0218 JavaScript File Write CVSS 4.0HIGH 8.4
  • TI-2016-06851 Out-of-bounds read in Foxit Reader CVSS 3.0MEDIUM 6.8
  • TI-2018-02932 Use after free in Foxit PDF Reader CVSS 3.1HIGH 7.8
  • TI-2018-02965 Use after free in Foxit PDF Reader CVSS 3.1HIGH 8.8
  • TI-2018-02964 Use after free in Foxit PDF Reader CVSS 3.1HIGH 8.8
  • TI-2018-02962 Use after free in Foxit PDF Reader CVSS 3.1HIGH 8.8
See all 120 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences