PT-2026-29437 · Foxitsoftware+1 · Foxit Pdf Editor+4

Suyue Guo · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-3777

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Multiple / Unspecified Products (affected versions not specified)

Description The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object may be destroyed while stale pointers are still kept and later dereferenced, which under crafted JavaScript and document structures can lead to a use-after-free condition and potentially allow arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-3777

Affected Products

Foxit Pdf Editor

Foxit Pdf Reader

Foxit Reader

Pdf Editor

Pdf Reader

References · 4

• https://foxit.com/support/security-bulletins.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3777 · Security Note
• https://twitter.com/CVEnew/status/2039279689752248522 · Twitter Post
• https://twitter.com/CVEarity/status/2039296045629538702 · Twitter Post