The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a use-after-free when the calculation runs and can potentially lead to arbitrary code execution.
References
| Link | Resource |
|---|---|
| https://www.foxit.com/support/security-bulletins.html | Vendor Advisory |
| https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2365 | Third Party Advisory Exploit |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
History
28 Apr 2026, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Foxit
Microsoft windows Microsoft Foxit pdf Reader Apple macos Apple Foxit pdf Editor |
|
| References | () https://www.foxit.com/support/security-bulletins.html - Vendor Advisory | |
| References | () https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2365 - Third Party Advisory, Exploit | |
| CPE | cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:* cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* |
|
| Summary |
|
01 Apr 2026, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 Apr 2026, 02:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-01 02:16
Updated : 2026-04-28 14:15
NVD link : CVE-2026-3779
Mitre link : CVE-2026-3779
CVE.ORG link : CVE-2026-3779
JSON object : View
Products Affected
microsoft
- windows
foxit
- pdf_editor
- pdf_reader
apple
- macos
CWE
CWE-416
Use After Free
