Foxit Pdf Editor CVE-2026-3779

The victim must open a crafted document (likely PDF or similar format with forms/calculations) in an application with list box calculation logic. Local attacker or malicious document delivery required. No authentication needed; user interaction (opening file) is mandatory.

Despite the high CVSS base score of 7.8, real-world exploitation risk requires careful assessment of multiple factors. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack vector requiring user interaction but no privileges and low complexity, meaning attackers need only convince users to open a malicious PDF file-a common and effective social engineering vector. However, no EPSS score is provided in the intelligence data, and critically, no confirmed active exploitation (not present in CISA KEV) or publicly available proof-of-concept code has been identified at time of analysis. The use-after-free primitive theoretically enables full code execution (C:H/I:H/A:H impact), but practical exploitation depends on heap layout predictability, ASLR/DEP bypass techniques, and renderer sandbox escape capabilities in modern Foxit versions. From an SSVC perspective: exploitation status is POC-unlikely (no public POC), automatable is NO (requires user interaction), technical impact is TOTAL (arbitrary code execution). This positions the vulnerability as a medium-term priority requiring patching but not emergency response unless threat intelligence indicates targeted exploitation attempts against your user base.

An attacker crafts a malicious PDF document embedding JavaScript code that creates form list boxes with calculation arrays, then programmatically triggers deletion and re-creation of the underlying page or form objects while calculations are pending. When a user opens this weaponized PDF in a vulnerable version of Foxit PDF Reader or Editor, the calculation engine executes with stale pointers to freed memory. The attacker leverages heap grooming techniques to position controlled data at the freed memory location, allowing the use-after-free to redirect execution flow to attacker-controlled shellcode. Successfully exploited, this grants the attacker arbitrary code execution in the context of the user's session, enabling malware installation, data exfiltration, or lateral movement within the victim's network.