CVE-2025-64512

CVE-2025-64512 – pdfminer.six Deserialization PoC Overview This proof-of-concept demonstrates a vulnerability in pdfminer.six CVE-2025-64512 that can lead to arbitrary command execution when a malicious PDF is processed. The exploit uses a crafted PDF that references a malicious, gzip-compressed...

CVE-2017-10952

CVE-2017-10952 So this is a high level example of a local code execution attack on Foxit PDF reader. Details of this attack can be found here 1. I've copy pasted the text description of this vulnerability linked in 1 here to preserve the description over time - the description was written by the...

CVE-2019-13288

CVE-2019-13288 – Infinite Recursion in Xpdf's Parser::getObj Overview CVE-2019-13288 is a vulnerability identified in Xpdf version 4.01.01 , specifically within the Parser::getObj function in Parser.cc. This flaw can lead to infinite recursion when processing a specially crafted PDF file, resulti...

PYSEC-2026-3913 pypdf: Possible infinite loop for TreeObject.insert_child

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a usually writing code path where TreeObject.insertchild is involved. Patches This has been fixed in pypdf==6.16.0. Workarounds If you cannot upgrade yet, consider applying the changes fr...

pypdf: Possible infinite loop for TreeObject.insert_child

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires a usually writing code path where TreeObject.insertchild is involved. PatchesThis has been fixed in pypdf==6.16.0. WorkaroundsIf you cannot upgrade yet, consider applying the changes from ...

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used. PatchesThis has been fixed in pypdf==6.16.1. WorkaroundsIf you cann...

PYSEC-2026-3911 pypdf: Possible long runtimes/large memory usage when extracting XForm objects

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used. Patches This has been fixed in pypdf==6.16.1. Workarounds If you...

CVE-2024-4367-hands-on

!IMPORTANT This repository is for learning about vulnerabilities. This hands-on must be performed on a computer you properly manage. Do not engage in any illegal activities. The author assumes no responsibility for any damages or liabilities arising from this repository. CVE-2024-4367-hands-on...

CVE-2025-64512

CVE-2025-64512 — pdfminer.six Insecure Deserialization Pickle via Crafted PDF ⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal. Table o...

CVE-2026-87585

A flaw was found in PDFium, a Portable Document Format PDF rendering engine. A remote attacker could exploit a double free vulnerability by providing a specially crafted PDF file. This could potentially lead to arbitrary code execution within the sandbox environment on Windows systems...

DEBIAN-CVE-2026-87585

Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: High...

CVE-2026-87585

Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: High...

DEBIAN-CVE-2026-87505

Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: Medium...

CVE-2026-87505

Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: Medium...

CVE-2026-87585

Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: High...

CVE-2026-87585

CVE-2026-87585 is a double free vulnerability in PDFium within Google Chrome on Windows prior to version 153.0.8010.36 . A remote attacker can potentially execute arbitrary code inside the browser sandbox by delivering a crafted PDF file. The Chromium security severity is rated High with a CVSS 3...

EUVD-2026-74487

Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: High...

CVE-2026-87585

Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: High...

PT-2026-88605

Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-87505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site...