CVE-2026-3778 — Stack exhaustion caused by cyclic references in Foxit PDF Editor/Reader

CVE-2026-3778

Stack exhaustion caused by cyclic references in Foxit PDF Editor/Reader PUBLISHED

Description (CNA)

The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.

Affected (CNA)

Vendor / product	Versions
Foxit Software Inc. / Foxit PDF Editor	affected Versions 2025.3 and earlier; affected Versions 14.0.2 and earlier; affected Versions 13.2.2 and earlier
Foxit Software Inc. / Foxit PDF Reader	affected Versions 2025.3 and earlier

CWE

CWE-674

References

https://www.foxit.com/support/security-bulletins.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.