CVE-2026-3777

The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object may be destroyed while stale pointers are still kept and later dereferenced, which under crafted JavaScript and document structures can lead to a use-after-free condition and potentially allow arbitrary code execution.

The following products are affected by CVE-2026-3777 vulnerability.

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-3777.

URL	Resource
https://www.foxit.com/support/security-bulletins.html