CVE-2026-3779 PUBLISHED

Foxit PDF Editor/Reader List Box Calculate Array Use-After-Free Vulnerability

Assigner: Foxit
Reserved: 08.03.2026 Published: 01.04.2026 Updated: 01.04.2026

The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a use-after-free when the calculation runs and can potentially lead to arbitrary code execution.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Product Status

Vendor Foxit Software Inc.
Product Foxit PDF Editor
Versions Default: unaffected
  • Version Versions 2025.3 and earlier is affected
  • Version Versions 14.0.2 and earlier is affected
  • Version Versions 13.2.2 and earlier is affected
Vendor Foxit Software Inc.
Product Foxit PDF Reader
Versions Default: unaffected
  • Version Versions 2025.3 and earlier is affected

References

Problem Types

  • CWE-416 Use after free CWE

Impacts

  • Potential arbitrary code execution