CVE-2026-3779 — Use After Free in Software INC Foxit PDF Editor

CWE-416 — Use After Free3 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 94.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Foxit Software INC Foxit PDF EditorFoxit Software INC Foxit PDF Reader
Timeline
PublishedApr 1

Description

The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a use-after-free when the calculation runs and can potentially lead to arbitrary code execution.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5foxit_software_inc/foxit_pdf_editorVersions 13.2.2 and earlier, Versions 14.0.2 and earlier, Versions 2025.3 and earlier+2
▶CVEListV5foxit_software_inc/foxit_pdf_readerVersions 2025.3 and earlier

🔴Vulnerability Details

2
CVEList
Foxit PDF Editor/Reader List Box Calculate Array Use-After-Free Vulnerability↗2026-04-01
▶
GHSA
GHSA-hcjp-55w9-473h: The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows cra↗2026-04-01
▶
CVE-2026-3779 — Use After Free | cvebase