What is the CVSS score of CVE-2026-3776?

CVE-2026-3776 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Foxit Pdf Editor CVE-2026-3776

EUVD-2026-17753 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-04-01 Foxit

Denial Of Service Null Pointer Dereference Foxit Pdf Editor Foxit Pdf Reader

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 01:45 euvd

EUVD-2026-17753

Analysis Generated

Apr 01, 2026 - 01:45 vuln.today

CVE Published

Apr 01, 2026 - 01:40 nvd

MEDIUM 5.5

DescriptionCVE.org

The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a crafted document to trigger a null pointer dereference and crash the application, resulting in denial of service.

AnalysisAI

Denial of service in Foxit PDF Editor and Foxit PDF Reader allows local attackers to crash the application by opening a crafted PDF containing a stamp annotation with missing appearance (AP) data. The vulnerability stems from insufficient validation before dereferencing annotation objects, triggering a null pointer exception. No public exploit code has been identified, and patch availability has not been confirmed from available advisory data.

Technical ContextAI

The vulnerability exists in PDF annotation handling within Foxit's PDF processing libraries. Specifically, stamp annotations in PDF documents are required to contain appearance (AP) dictionaries that define how the annotation should be rendered. The affected code attempts to access stamp annotation resources without first validating that the AP entry exists or is valid, violating the principle of defensive programming. CWE-476 (Null Pointer Dereference) describes the root cause: the application dereferences a null or uninitialized pointer when the expected AP data is absent. Foxit PDF Editor and Foxit PDF Reader are consumer and enterprise PDF manipulation tools that parse and render PDF documents, making them direct attack surfaces when processing untrusted PDF files.

RemediationAI

Users should check Foxit's security bulletins at https://www.foxit.com/support/security-bulletins.html for patch availability and exact fixed versions for both Foxit PDF Editor and Foxit PDF Reader. Once patched versions are released, upgrade to the latest version that addresses CVE-2026-3776. As an interim mitigation, restrict opening of untrusted PDF files or implement document scanning and validation workflows that reject PDFs with malformed or incomplete annotation structures. Organizations using Foxit in automated workflows should consider temporarily disabling stamp annotation rendering or sandboxing PDF processing operations until patches are applied.