NULL pointer dereference in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2026-3776

Vulnerability identifier: #VU124715

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-3776

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference in stamp annotation handling when opening PDFs missing the appearance (AP) entry. A remote attacker can trick the victim into opening a specially crafted PDF file to cause a denial of service.

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Editor for Mac (formerly PhantomPDF)
Foxit PDF Reader for Mac

Install security update from vendor's website.

Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 13.2.3.24041, 14.0.3.33502, 2026.1.0.36452
Foxit PDF Reader for Windows - update to 2026.1.0.36452
Foxit PDF Editor for Mac (formerly PhantomPDF) - addressed in versions 13.2.3.63444, 14.0.3.69295, 2026.1.0.70169
Foxit PDF Reader for Mac - update to 2026.1.0.70169

• https://www.foxitsoftware.com/support/security-bulletins.html?Security+updates+available+in+Foxit+PDF+Reader+2026.1+and+Foxit+PDF+Editor+2026.12026-03-31+00%3A00%3A00

• Multiple vulnerabilities in Foxit PDF Reader and PDF Editor for Windows
• Multiple vulnerabilities in Foxit PDF Editor and Reader for Mac