CVE-2026-3778CWE-674

Stack exhaustion caused by cyclic references in Foxit PDF Editor/Reader

Medium · published April 1, 2026

CVSS v3.1
6.2
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00147 · 3.6th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-04-01T01:40Z
EPSS history
Timeline
  • 01 APR 01:40Z
    Stack exhaustion caused by cyclic references in Foxit PDF Editor/Reader
    cvelistv5