CVE-2026-3776

Null pointer dereference in Foxit PDF Editor/Reader when accessing stamp annotation

Published Apr 1, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a crafted document to trigger a null pointer dereference and crash the application, resulting in denial of service.

Analysis

Technical impact

Foxit PDF Editor and Reader contain a null pointer dereference when processing stamp annotations that lack required appearance data. A crafted PDF document can trigger the application to crash, leading to a denial of service for the affected user.

Affected Systems

Products affected are Foxit PDF Editor and Foxit PDF Reader across platforms supported by the application, including macOS and Windows. No specific version information is provided, so all current releases should be checked for updates.

Risk and Exploitability

The vulnerability has a CVSS score of 5.5, indicating moderate severity, and an EPSS score of less than 1 percent, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Attackers could exploit it by creating and opening a malicious PDF file, typically from a user’s local environment or from an untrusted source. The impact is limited to application crashes without privilege escalation or data theft.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Foxit Software Inc.

Foxit PDF Editor

unaffected

Version	Status	Constraints
`Versions 2025.3 and earlier`	affected	—
`Versions 14.0.2 and earlier`	affected	—
`Versions 13.2.2 and earlier`	affected	—

Foxit Software Inc.

Foxit PDF Reader

unaffected

Version	Status	Constraints
`Versions 2025.3 and earlier`	affected	—

Configuration 1 [-]

AND

OR	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_reader::::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_editor::::::::
	cpe:2.3:a:foxit:pdf_reader::::::::

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Foxitsoftware

Foxit Pdf Editor

Version	Status	Scheme	Platform
`[0,2025.3]`	affected	generic	['windows', 'macos']
`[0,14.0.2]`	affected	semver	['windows', 'macos']
`[0,13.2.2]`	affected	semver	['windows', 'macos']

Foxitsoftware

Foxit Reader

Version	Status	Scheme	Platform
`[0,2025.3]`	affected	generic	['windows', 'macos']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Foxit PDF Editor or Reader to the latest version that includes the fix.
Verify that the update is installed on all devices running the application.
If an update is not yet available, restrict opening of PDFs from untrusted sources until the patch is applied.

Generated by OpenCVE AI on April 14, 2026 at 21:07 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.108% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.foxit.com/support/security-bulletins.html

History

Apr 14, 2026 6:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Foxit Foxit pdf Editor Foxit pdf Reader Microsoft Microsoft windows
CPEs		cpe:2.3:a:foxit:pdf_editor:::::::: cpe:2.3:a:foxit:pdf_reader:::::::: cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*
Vendors & Products		Apple Apple macos Foxit Foxit pdf Editor Foxit pdf Reader Microsoft Microsoft windows

Apr 3, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Foxitsoftware Foxitsoftware foxit Pdf Editor Foxitsoftware foxit Reader
Vendors & Products		Foxitsoftware Foxitsoftware foxit Pdf Editor Foxitsoftware foxit Reader

Apr 1, 2026 11:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 1, 2026 2:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a crafted document to trigger a null pointer dereference and crash the application, resulting in denial of service.
Title		Null pointer dereference in Foxit PDF Editor/Reader when accessing stamp annotation
Weaknesses		CWE-476
References		https://www.foxit.com/support/security-bulletins.html
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}`