Foxit Pdf Editor CVE-2026-3777

While the CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) describes a local, low-complexity attack requiring user interaction with high availability impact but no confidentiality or integrity impact, the tagging of this as an RCE vulnerability and the underlying CWE-416 (use-after-free) classification suggest the actual exploitability is higher than the CVSS score alone indicates. Use-after-free flaws in memory-unsafe code (C/C++, typical for PDF rendering engines) frequently permit arbitrary code execution through heap spray or other memory manipulation techniques. The requirement for local access and user interaction (opening a malicious PDF) limits attack surface compared to remote RCE, but remains practical in social engineering scenarios. The absence of KEV status and public exploit code confirmation means no confirmed active exploitation has been disclosed, but the mature Foxit attack surface and public disclosure suggest POC development is probable.

An attacker crafts a malicious PDF document containing embedded JavaScript that sequentially modifies the document zoom level and triggers a page navigation event. When a user opens this PDF in Foxit PDF Editor or Reader, the JavaScript executes automatically, causing the view cache pointers to become invalid. By carefully structuring the JavaScript and document layout, the attacker can control the heap state to cause the subsequent dereferencing of the stale pointer to read or write to attacker-controlled memory, ultimately achieving code execution with the privileges of the user running the PDF application. No public exploit code has been confirmed at this time, but the straightforward nature of use-after-free exploitation in PDF renderers suggests POC development is feasible.