CVE-2026-57254

There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to perform proper type checking, ultimately causing the application to crash...

CVE-2026-57245

When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an...

CVE-2026-13127

The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnails still use the invalid page objects, ultimately causing the application to crash...

CVE-2026-57242

The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management and null value validation; when the page state changes, the application continuously dereferences invalid objects, eventually leading to a crash...

EUVD-2026-42204

After the application opened the PDF file, the script first reset the annotation status, then triggered the reset form event by additional action. During the re-entry process, the application access invalid objects and crashed...

EUVD-2026-42193

When the application opens a PDF and JavaScript resets the form fields, the script re-enters the interface. The underlying native object is damaged, but the application does not perform validation. The function call on the damaged object leads to the application crashing...

CVE-2026-57256

When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form is reset. During this process, the application failed to adequately verify the validity of the form objects and their internal dictionary...

EUVD-2026-41375

In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized...

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...

CVE-2026-12460

Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: High...

CVE-2026-12460

Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: High...

CVE-2026-53900 Cookie injection was possible when opening a PDF link

Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0...

Agent Zero SSRF

The vulnerability of the handlepdfdocument function in the framework for creating AI agents like Agent Zero is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute an SSRF attack...

CVE-2026-5939

A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution...

ai.telosforge:kimaira-starter-etl (>=1.2.4, <=1.2.6), cn.echoparrot:echoparrot-application (25.4.0) +15 more potentially affected by CVE-2026-40980 via org.springframework.ai:spring-ai-pdf-document-reader (>=1.1.0, <=1.1.2)

org.springframework.ai:spring-ai-pdf-document-reader MAVEN version =1.1.0, =1.2.4, =25.4.0, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =.30.0.rc1, =3.30.0.rc16 and more Source cves: CVE-2026-40980 Source advisory: OSV:...

com.alibaba.cloud.ai:spring-ai-alibaba-starter-document-parser-apache-pdfbox (>=1.0.0.1, <=1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-document-parser-bibtex (>=1.0.0.1, <=1.0.0.4) +6 more potentially affected by CVE-2026-40980 via org.springframework.ai:spring-ai-pdf-document-reader (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-pdf-document-reader MAVEN version =1.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.4 - com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin 1.0.0.4 - com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core 1.0.0.4 -...

ai.telosforge:kimaira-starter-etl (>=1.2.4, <=1.2.6), cn.echoparrot:echoparrot-application (25.4.0) +15 more potentially affected by CVE-2026-40980 via org.springframework.ai:spring-ai-pdf-document-reader (>=1.1.0, <=1.1.2)

org.springframework.ai:spring-ai-pdf-document-reader MAVEN version =1.1.0, =1.2.4, =25.4.0, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =.30.0.rc1, =3.30.0.rc16 and more Source cves: CVE-2026-40980 Source advisory: GHSA...

com.alibaba.cloud.ai:spring-ai-alibaba-starter-document-parser-apache-pdfbox (>=1.0.0.1, <=1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-document-parser-bibtex (>=1.0.0.1, <=1.0.0.4) +6 more potentially affected by CVE-2026-40980 via org.springframework.ai:spring-ai-pdf-document-reader (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-pdf-document-reader MAVEN version =1.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.4 - com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin 1.0.0.4 - com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core 1.0.0.4 -...

GHSA-26GG-9GV2-V27J Spring AI Vulnerable to OOM by attacker-controlled PDF

In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by ForkPDFLayoutTextStripper. Affected versions: Spring AI: 1.0.0 - 1.0.5 fixed in 1.0.6, 1.1.0 - 1.1.4 fixed in 1.1.5...

ai.telosforge:kimaira-starter-etl (>=1.2.4, <=1.2.6), cn.echoparrot:echoparrot-application (25.4.0) +15 more potentially affected by CVE-2026-40980 via org.springframework.ai:spring-ai-pdf-document-reader (>=1.1.0, <=1.1.2)

org.springframework.ai:spring-ai-pdf-document-reader MAVEN version =1.1.0, =1.2.4, =25.4.0, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =.30.0.rc1, =3.30.0.rc16 and more Source cves: CVE-2026-40980 Source advisory: MEND...