What is the CVSS score of CVE-2026-3774?

CVE-2026-3774 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Foxit Pdf Editor CVE-2026-3774

EUVD-2026-17749 MEDIUM

Information Exposure (CWE-200)

2026-04-01 Foxit

GHSA-whcx-f2rj-66hj

Information Disclosure Foxit Pdf Editor

4.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.7 MEDIUM

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 01:45 euvd

EUVD-2026-17749

Analysis Generated

Apr 01, 2026 - 01:45 vuln.today

CVE Published

Apr 01, 2026 - 01:40 nvd

MEDIUM 4.7

DescriptionCVE.org

The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (OCGs) immediately before or after redaction, encryption, or printing. These script‑driven updates are not fully covered by the existing redaction, encryption, and printing logic, which, under specific document structures and user workflows, may cause a small amount of sensitive content to remain unremoved or unencrypted as expected, or result in printed output that slightly differs from what was reviewed on screen.

AnalysisAI

Foxit PDF Editor allows PDF JavaScript and document actions (WillPrint/DidPrint) to modify form fields, annotations, and optional content groups immediately before or after redaction, encryption, or printing, potentially causing sensitive content to remain visible or unencrypted despite user expectations. The vulnerability affects all versions of Foxit PDF Editor and requires local access with user interaction (opening a malicious PDF). CVSS score is 4.7 with high confidentiality impact; no public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.

Technical ContextAI

The vulnerability exists in Foxit PDF Editor's implementation of PDF document processing, specifically in the JavaScript execution engine and its integration with PDF redaction, encryption, and printing workflows. PDF JavaScript can be embedded in documents and triggered by application actions (WillPrint, DidPrint events) that execute during the redaction, encryption, or print preparation phases. The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) stems from insufficient validation and sequencing controls: the redaction, encryption, and printing logic does not properly account for or prevent script-driven modifications to document state during these critical security operations. This allows an attacker to craft a PDF where JavaScript updates form field values, annotation content, or optional content group visibility states in a narrow window of execution, bypassing the intended redaction or encryption coverage. The vulnerability is specific to how Foxit's PDF engine handles the interaction between JavaScript execution contexts and the atomic redaction/encryption/print operations.

RemediationAI

Contact Foxit Software or visit their security bulletins page (https://www.foxit.com/support/security-bulletins.html) to identify the patched version for your Foxit PDF Editor installation and download the update immediately. Foxit has released a security bulletin addressing this vulnerability; apply the vendor-recommended patch to all affected installations. As an interim measure, avoid opening untrusted PDF documents in Foxit PDF Editor and disable JavaScript execution in PDF documents if not required for your workflow (check Foxit settings under Preferences > Security or equivalent). Do not rely on PDF redaction or encryption operations in Foxit PDF Editor on potentially malicious documents until patched.