CVE-2026-3776

mediumpriority · track · 0EPSS 0.001 · 1 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.10% (1st) EPSS

CVSS 5.5 · medium

Is it mine?

20 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a crafted document to trigger a null pointer dereference and crash the application, resulting in denial of service.

cvss

Technical severity, 0–10. One row per scoring source.

5.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:Hsecondaryexploitability 1.8 · impact 3.6

v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-476US

affected products (20)

Products and version ranges known to be affected.

Foxit PDF Editor <2026.1all versionscert_bundDE
Foxit PDF Reader <2026.1all versionscert_bundDE
Foxit PDF Editor< 2026.1cert_bundDE
Foxit PDF Reader< 2026.1cert_bundDE
Foxit Software Inc. Foxit PDF Editor≤ Versions 2025.3 and earlierenisa_euvdEU
Foxit Software Inc. Foxit PDF Editor≤ Versions 13.2.2 and earlierenisa_euvdEU
Foxit Software Inc. Foxit PDF Editor≤ Versions 14.0.2 and earlierenisa_euvdEU
Foxit Software Inc. Foxit PDF Reader≤ Versions 2025.3 and earlierenisa_euvdEU
foxit pdf editor≤ 13.2.2.63349nvdUScpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
foxit pdf editor≤ 13.2.2.24014nvdUScpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
foxit pdf editor14.0.0.33046 → 14.0.2.33402nvdUScpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
foxit pdf editor14.0.0.68868 → 14.0.2.69164nvdUScpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
foxit pdf editor2023.1.0.15510 → 2023.3.0.23028nvdUScpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
foxit pdf editor2023.1.0.55583 → 2023.3.0.63083nvdUScpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
foxit pdf editor2024.1.0.23997 → 2024.4.1.27687nvdUScpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
foxit pdf editor2024.1.0.63682 → 2024.4.1.66479nvdUScpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
foxit pdf editor2025.1.0.27937 → 2025.3.0.35737nvdUScpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
foxit pdf editor2025.1.0.66692 → 2025.3.0.69570nvdUScpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
foxit pdf reader≤ 2025.3.0.35737nvdUScpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*
foxit pdf reader≤ 2025.3.0.69570nvdUScpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-0934Foxit PDF Editor und Reader: Mehrere SchwachstellenDeutsch2026-03-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Foxit PDF Editor und Foxit PDF Reader ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen oder Code auszuführen. .

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd NVD CVE.org MITRE

published 2026-04-01modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan