Foxit Pdf Editor CVE-2026-3774

The CVSS vector (AV:L/AC:H/PR:N/UI:R) indicates local attack vector, high complexity, no privileges required, and requires user interaction-all factors that limit real-world exploitability despite the high confidentiality impact (C:H). The attack requires an attacker to craft a specific document structure and user workflow that triggers the JavaScript at precisely the right moment in the redaction/encryption/print lifecycle; this is difficult to replicate reliably (AC:H). EPSS and KEV data are not provided in the intelligence, so exploitation probability cannot be quantified from those signals. The lack of a public proof-of-concept and no CISA KEV status suggests this is not yet being weaponized or actively exploited in the wild. However, the vulnerability is real and affects a security-critical use case (document redaction and encryption); organizations that rely on Foxit PDF Editor for sensitive document handling should prioritize patching, as a motivated attacker with document distribution channels could exploit this in targeted scenarios. The high conditional impact (sensitive data leakage) combined with moderate accessibility barriers makes this a medium-priority vulnerability rather than a critical emergency.

An attacker creates a malicious PDF document containing embedded JavaScript in the WillPrint or DidPrint action handler. When a user opens the document and initiates a redaction operation (e.g., marking sensitive text for removal) or encryption operation, the JavaScript executes during the processing phase and modifies form field values or annotation content to restore redacted text or bypass encryption markers. The user reviews the document on screen, sees it as properly redacted or encrypted, and then prints or saves it; however, the script-driven updates cause a small portion of sensitive content to remain visible in the final output or to bypass encryption. The user is unaware that the redaction/encryption did not fully take effect because the script execution occurred in a narrow window outside the main redaction/encryption logic.