CVE-2026-71870: Uncontrolled Resource Consumption

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/cmap.py function parsebfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed...

PT-2026-69074

Name of the Vulnerable Software and Affected Versions ClamAV affected versions not specified Description A flaw in the PDF file format parser allows an unauthenticated remote attacker to cause a Denial of Service DoS or other impacts via memory corruption. The issue stems from improper boundary...

CVE-2026-20346: Out-of-bounds Read

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

Linux Distros Unpatched Vulnerability : CVE-2026-71852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/font.py...

CVE-2026-8325

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

CVE-2026-1289

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process...

NPM: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

NPM: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633 vulnerability discovered by ? in WordPress Npm ngx-extended-pdf-viewer versions = 27.0.0-rc.0, 29.0.0-rc.3...

Cross-site Scripting (XSS)

Overview org.webjars.npm:pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript...

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF vulnerability discovered by ? in WordPress Npm pdfjs-dist versions = 5.6.83, 6.2.108...

Cross-site Scripting (XSS)

Overview pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript code in the...

GHSA-HQ66-CQWQ-W95J PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true which is the default value and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches Workarounds Set...

CVE-2026-11803 PDF File Parsing Out-of-Bounds Read Vulnerability in in Certain Autodesk Desktop Products

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2026-11803

Autodesk Revit is affected by CVE-2026-11803 due to a PDF file parsing Out-of-Bounds Read. The issue arises when a malicious PDF is processed by Revit, potentially allowing a crash, reading of sensitive data, or execution of arbitrary code within the process. The provided metrics indicate a HIGH ...

CVE-2026-11803 PDF File Parsing Out-of-Bounds Read Vulnerability in in Certain Autodesk Desktop Products

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2026-8325

CVE-2026-8325 describes an out-of-bounds write vulnerability in Autodesk Revit triggered by parsing a malicious PDF. The affected flow is PDF parsing within Revit, with the root cause an out-of-bounds write that may cause a crash, data corruption, or arbitrary code execution in the context of the...

CVE-2026-8325 PDF File Parsing Out-of-Bounds Write Vulnerability in Certain Autodesk Desktop Products

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

CVE-2026-8325 PDF File Parsing Out-of-Bounds Write Vulnerability in Certain Autodesk Desktop Products

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

CVE-2026-1289

CVE-2026-1289 concerns Autodesk Revit. A maliciously crafted PDF file that is parsed by Revit can trigger a Use-After-Free vulnerability in the PDF parsing component. Exploitation could cause a crash, disclose sensitive data, or allow arbitrary code execution within the current process. The CVSS ...

CVE-2026-1289 PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process...

CVE-2026-18597

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure...