1. Home
  2. CVE Database
  3. CVE-2026-3777
MEDIUM · 5.5

CVE-2026-3777

The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property...

Vulnerability Description

The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object may be destroyed while stale pointers are still kept and later dereferenced, which under crafted JavaScript and document structures can lead to a use-after-free condition and potentially allow arbitrary code execution.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
FoxitPdf Editor<= 13.2.2.24014
FoxitPdf Reader<= 2025.3.0.35737
MicrosoftWindows-
AppleMacos-

Related Weaknesses (CWE)

CWE-416

References

FAQ

What is CVE-2026-3777?

CVE-2026-3777 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property...

How severe is CVE-2026-3777?

CVE-2026-3777 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-3777?

Check the references section above for vendor advisories and patch information. Affected products include: Foxit Pdf Editor, Foxit Pdf Reader, Microsoft Windows, Apple Macos.