CVE-2026-3778: Stack exhaustion caused by cyclic references in Foxit PDF Editor/Reader
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3778?
CVE-2026-3778 is classified as a high severity vulnerability due to its potential to cause stack exhaustion.
How do I fix CVE-2026-3778?
To fix CVE-2026-3778, users should update to the latest version of Foxit PDF Editor or Foxit Reader that contains the security patch.
What are the potential impacts of CVE-2026-3778?
The potential impacts of CVE-2026-3778 include application crashes or denial of service due to stack exhaustion.
Which products are affected by CVE-2026-3778?
CVE-2026-3778 affects Foxit PDF Editor and Foxit Reader across all versions.
What exploit methods are associated with CVE-2026-3778?
Exploitation of CVE-2026-3778 can occur through crafted PDF files that use cyclic references in JavaScript.