Uncontrolled Recursion in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2026-3778

Vulnerability identifier: #VU124718

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-3778

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to uncontrolled recursion in object reference handling when processing PDFs with cyclic references. A remote attacker can trick the victim into opening a specially crafted PDF file to cause a stack overflow and crash the application.

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Editor for Mac (formerly PhantomPDF)
Foxit PDF Reader for Mac

Install security update from vendor's website.

Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 13.2.3.24041, 14.0.3.33502, 2026.1.0.36452
Foxit PDF Reader for Windows - update to 2026.1.0.36452
Foxit PDF Editor for Mac (formerly PhantomPDF) - addressed in versions 13.2.3.63444, 14.0.3.69295, 2026.1.0.70169
Foxit PDF Reader for Mac - update to 2026.1.0.70169

• https://www.foxitsoftware.com/support/security-bulletins.html?Security+updates+available+in+Foxit+PDF+Reader+2026.1+and+Foxit+PDF+Editor+2026.12026-03-31+00%3A00%3A00

• Multiple vulnerabilities in Foxit PDF Reader and PDF Editor for Windows
• Multiple vulnerabilities in Foxit PDF Editor and Reader for Mac