CVE-2026-3776CWE-476

Null pointer dereference in Foxit PDF Editor/Reader when accessing stamp annotation

Medium · published April 1, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a crafted document to trigger a null pointer dereference and crash the application, resulting in denial of service.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00148 · 3.7th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-04-01T01:40Z
EPSS history
Timeline
  • 01 APR 01:40Z
    Null pointer dereference in Foxit PDF Editor/Reader when accessing stamp annotation
    cvelistv5