Pdf

An XML External Entity (XXE) injection vulnerability (CVE-2026-54078, CWE-611) in the veraPDF-validation library's `validation-model` module allows a remote attacker to read arbitrary files from the server's file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text entry, which is then parsed by an insecure `DocumentBuilderFactory`.

A critical XML External Entity Injection (XXE) vulnerability, CVE-2026-54079, in veraPDF's validation-model module allows a remote attacker to read arbitrary files on the server file system or perform Server-Side Request Forgery (SSRF) by submitting a crafted PDF containing a malicious XFA stream, due to insecure XML parsing defaults.

A denial-of-service vulnerability (CVE-2026-59200) exists in Pillow's `PdfParser.PdfStream.decode()` function across versions 5.1.0 to 12.2.x, allowing an unauthenticated attacker to craft a malicious PDF file that, when processed by a vulnerable application, triggers excessive memory allocation (e.g., a ~950 KB file expanding to 1 GB), leading to server Out-of-Memory termination or severe service degradation.

An arbitrary code execution vulnerability exists in BabelDOC's vendored PDF parser (`babeldoc/pdfminer/cmapdb.py`) due to insecure deserialization of untrusted pickle data, allowing an attacker to craft a PDF with a specially encoded '/Encoding' name containing an absolute path that bypasses directory restrictions, leading to deserialization and execution of a malicious '.pickle.gz' file on the local filesystem with the privileges of the BabelDOC process.

Multiple critical vulnerabilities, including CVE-2026-13126 and CVE-2026-13127, have been discovered in Foxit PDF Editor and Reader for Windows and macOS, enabling a remote attacker to achieve arbitrary code execution, elevate privileges, and compromise data confidentiality if users open a crafted malicious PDF document.

The pdf-image npm package through version 2.0.0 is vulnerable to OS command injection via the pdfFilePath parameter due to improper sanitization, potentially leading to arbitrary code execution.

Adversaries may exploit vulnerabilities in PDF reader applications or use social engineering to execute malicious commands, often spawning system utilities for discovery or defense evasion purposes.