The PDF format was designed to represent documents faithfully across different platforms. Over four decades, it has accumulated features that go far beyond static document display: JavaScript execution, embedded file attachments, form submission, multimedia embedding, and external URL references. Each of these features is an attack surface.
Organizations process thousands of PDFs daily -- invoices, contracts, reports, resumes. Most of these documents flow through automated systems that parse PDF content without the security scrutiny applied to executable files. That processing pipeline is a supply chain attack vector.
Attack Surface Overview
JavaScript in PDFs
The PDF specification includes a JavaScript engine. Adobe Reader and other viewers support embedded JavaScript that executes when the document is opened, when a page is displayed, or when form fields are interacted with.
PDF JavaScript has been the source of dozens of remote code execution vulnerabilities. Bugs in the JavaScript interpreter, the bridge between JavaScript and the rendering engine, and the implementation of PDF-specific JavaScript APIs have all been exploited in the wild.
Even without exploiting a vulnerability, PDF JavaScript can phish credentials by displaying fake login dialogs, redirect users to malicious URLs, or exfiltrate data from form fields.
Embedded Files and Launch Actions
PDFs can contain embedded files and launch actions that attempt to open external applications. A PDF can embed an executable and prompt the user to open it. While modern readers warn about launch actions, older viewers and automated processing systems may not.
External References
PDFs can reference external resources: URLs, SMB shares, and even LDAP servers. When a viewer processes these references, it may leak credentials (through NTLM authentication to SMB shares) or make network connections that reveal information about the viewer environment.
Font Parsing
PDFs embed font data in multiple formats: TrueType, OpenType, Type 1, and CFF. Font parsing has been a rich source of memory corruption vulnerabilities. The complexity of font format specifications, combined with the need for high-performance rendering, creates conditions where parsing bugs are both common and exploitable.
Image Processing
PDFs embed images in JPEG, JPEG2000, JBIG2, and other formats. Each image format has its own parsing code, and vulnerabilities in image decoders have been used for PDF-based exploitation. The JBIG2 decoder in particular has been a repeated source of high-severity bugs, including the ForcedEntry exploit used by NSO Group.
Supply Chain Attack Scenarios
Compromised Invoice Processing
Many organizations use automated PDF processing to extract data from invoices. An attacker who compromises a vendor email account can send invoices containing malicious PDFs. The automated processing system parses the PDF, triggering a vulnerability in the PDF library, and the attacker gains access to the invoice processing infrastructure.
From there, the attacker can modify payment details, exfiltrate financial data, or pivot to other internal systems.
Malicious Documentation in Software Packages
Software packages sometimes include PDF documentation. A supply chain attacker who gains access to a package repository could include a crafted PDF in the documentation directory. When a developer opens the documentation, the PDF exploit executes.
Weaponized Reports and Contracts
Organizations exchange PDF reports and contracts with partners, vendors, and regulators. An attacker who compromises a partner organization can modify outgoing PDFs to include exploits. The receiving organization trusts documents from the partner and processes them without additional scrutiny.
Vulnerable Libraries
The security of your PDF processing depends entirely on which library you use.
Poppler is the most widely deployed open-source PDF rendering library on Linux. It has had numerous CVEs, though its active development and fuzzing coverage have improved quality over time.
MuPDF is a lightweight PDF renderer known for good performance. It has had fewer CVEs than Poppler but has still had serious vulnerabilities, particularly in font and image parsing.
pdf.js (Mozilla) renders PDFs in JavaScript within the browser. Its attack surface is limited by the browser sandbox, making exploitation significantly harder. For web-based PDF viewing, pdf.js is generally the safest option.
PDFium (Google) is the PDF renderer used in Chrome. Like pdf.js, it benefits from the browser sandbox and extensive fuzzing through OSS-Fuzz.
Apache PDFBox is a popular Java library for PDF processing. It has had vulnerabilities in XML processing (XXE) and out-of-memory conditions triggered by crafted PDFs.
Defense Strategies
Sandbox PDF processing. Run PDF parsing in an isolated environment (container, VM, or seccomp sandbox) where a compromised parser cannot access sensitive systems. This is the single most effective mitigation.
Disable JavaScript in PDF viewers. Unless you specifically need PDF JavaScript (most organizations do not), disable it in your viewer configuration and organizational policies.
Strip active content. Before processing PDFs in automated systems, sanitize them by stripping JavaScript, launch actions, and embedded files. Tools like QPDF can flatten PDFs to remove active content while preserving the document appearance.
Use memory-safe parsers. When choosing a PDF library, prefer implementations in memory-safe languages or those with extensive fuzzing coverage. pdf.js and PDFium are generally safer choices than native C libraries.
Keep libraries updated. PDF parsing libraries receive frequent security patches. Ensure your processing infrastructure uses current versions and that updates are applied promptly.
How Safeguard.sh Helps
Safeguard.sh tracks the PDF processing libraries in your application dependencies. Whether you use PDFBox, Poppler, MuPDF, or another library, our platform monitors for known vulnerabilities and alerts you to security updates. Our SBOM generation identifies PDF processing components across your infrastructure, ensuring that when a critical PDF parser vulnerability drops, you know exactly which applications are affected.