Main Vulnerability Database Vulnerabilities #VU124714

Insecure DLL loading in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2026-3780

Published: March 31, 2026 / Updated: August 6, 2026

Vulnerability identifier: #VU124714

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-3780

CWE-ID: CWE-427

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner. A remote attacker can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system.

Affected software

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows

How to mitigate CVE-2026-3780

Install security update from vendor's website.

Foxit PDF Editor (formerly Foxit PhantomPDF) - update to 2026.1.0.36452
Foxit PDF Reader for Windows - update to 2026.1.0.36452

Links to Public Exploits and PoC-codes

Exploit #12869 - CVE-2026-57239 (Proof of concept exploit for CVE-2026-3775/CVE-2026-3780 and CVE-2026-57239 which lets you obtain NT AUTHORITY\SYSTEM rights via the Foxit PDF Reader updater service.) (August 6, 2026)

External References

https://www.foxitsoftware.com/support/security-bulletins.html?Security+updates+available+in+Foxit+PDF+Reader+2026.1+and+Foxit+PDF+Editor+2026.12026-03-31+00%3A00%3A00

Related Security Bulletins

Multiple vulnerabilities in Foxit PDF Reader and PDF Editor for Windows