What’s Vulnerable › Vulnerabilities
CVE-2026-3776: Null pointer dereference in Foxit PDF Editor/Reader when accessing stamp annotation
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-01 · updated 2026-06-17
- Weakness: CWE-476
Description
The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a crafted document to trigger a null pointer dereference and crash the application, resulting in denial of service.
Affected products
- Foxit PDF Reader: through 13.2.2.24014; from 14.0.0.33046 through 14.0.2.33402; from 2023.1.0.15510 through 2023.3.0.23028; from 2024.1.0.23997 through 2024.4.1.27687; from 2025.1.0.27937 through 2025.3.0.35737; through 13.2.2.63349
- Foxit Pdf Reader: through 2025.3.0.35737; through 2025.3.0.69570
References
Get alerted when CVE-2026-3776 or the next vulnerability affects your stack