What is the CVSS score of CVE-2026-3778?

CVE-2026-3778 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Foxit Pdf Editor CVE-2026-3778

EUVD-2026-17757 MEDIUM

Uncontrolled Recursion (CWE-674)

2026-04-01 Foxit

Denial Of Service Foxit Pdf Editor Foxit Pdf Reader

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 01:45 euvd

EUVD-2026-17757

Analysis Generated

Apr 01, 2026 - 01:45 vuln.today

CVE Published

Apr 01, 2026 - 01:40 nvd

MEDIUM 6.2

DescriptionCVE.org

The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.

AnalysisAI

Foxit PDF Editor and PDF Reader are vulnerable to denial of service via uncontrolled recursion in maliciously crafted PDF documents containing cyclic object references in pages and annotations. When such documents are processed by APIs performing deep object traversal (such as SOAP handlers), the applications exhaust stack memory and crash. The vulnerability requires only local access and no user interaction beyond opening a malicious PDF, making it a practical attack vector for local denial of service.

Technical ContextAI

The vulnerability stems from improper handling of cyclic object references in PDF document structures (CWE-674: Uncontrolled Recursion). PDF objects-particularly pages and annotation dictionaries-can reference each other, and when a parser or API traversal routine encounters these cycles without cycle detection, it enters infinite recursion. This is particularly dangerous when documents are processed by SOAP or other deep-traversal APIs that recursively inspect all referenced objects. The issue affects Foxit PDF Editor and Foxit PDF Reader across multiple versions, as indicated by the wildcard version matching in the CPE strings, suggesting the flaw may exist in core PDF parsing logic shared across product versions.

RemediationAI

Foxit users should consult the official security bulletin at https://www.foxit.com/support/security-bulletins.html for specific patched versions of Foxit PDF Editor and Foxit PDF Reader. The primary mitigation is upgrading to a patched release once available. In the interim, organizations should restrict PDF processing workflows to trusted sources and avoid opening PDF attachments from untrusted senders in these applications. If automated batch PDF processing is in use, consider temporarily disabling or sandboxing such workflows until patches are deployed. Additionally, implementing input validation to reject PDFs with excessive or cyclic object nesting may reduce exposure, though vendor patches are the definitive fix.