Home
MEDIUM: 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDefault status
unaffected
Versions 2025.3 and earlier
affected
Versions 14.0.2 and earlier
affected
Versions 13.2.2 and earlier
affected
Default status
unaffected
Versions 2025.3 and earlier
affected
Description
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.
Problem types
CWE-674: Uncontrolled Recursion
Product status
Versions 2025.3 and earlier
Versions 14.0.2 and earlier
Versions 13.2.2 and earlier
Versions 2025.3 and earlier
Credits
Suyue Guo from UCSB Seclab
References
www.foxit.com/support/security-bulletins.html