CVE-2026-3778
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF.
Published Apr 1, 2026 · updated Jun 17, 2026 · foxit pdf editor
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 1, 2026 · NIST NVD
Detected
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.
Jun 17, 2026 · NIST NVD
Updated
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.
Affected
- cpe foxit/pdf editorversion unspecified
- cpe foxit/pdf readerversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-3778
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-3778
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled
nvd.nist.gov