medium5.5
CVE-2026-3776
The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources.
Impact
The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a crafted document to trigger a null pointer dereference and crash the application, resulting in denial of service.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Foxit | Pdf Editor | through 13.2.2.24014 from 14.0.0.33046 through 14.0.2.33402 from 2023.1.0.15510 through 2023.3.0.23028 from 2024.1.0.23997 through 2024.4.1.27687 from 2025.1.0.27937 through 2025.3.0.35737 through 13.2.2.63349 |
| Foxit | Pdf Reader | through 2025.3.0.35737 through 2025.3.0.69570 |