CVE-2026-3778 — Stack exhaustion caused by cyclic references in Foxit PDF Editor/Reader
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other …
Published: 2026-04-01 · CVSS: 6.2 · CVSS 3.1
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7