PDF Ecosystem Vulnerabilities Enable One-Click Attacks and PDF Object Injection

Security researchers reported multiple previously unknown weaknesses across the PDF ecosystem that can be exploited through crafted documents. Novee Security’s research into Foxit and Apryse PDF platforms described 13 vulnerability categories and 16 exploit paths, including critical XSS and OS command injection, with “one-click” scenarios where simply opening a document could trigger compromise and potentially enable account takeover or backend command execution.

Separately, a high-severity flaw in the widely used jsPDF library was disclosed as CVE-2026-25755 (CVSS 8.8), enabling PDF object injection via improper sanitization in the addJS method. By breaking out of the /JS (...) string (e.g., injecting ) >> /Action ...), an attacker can inject arbitrary PDF structures and actions such as /OpenAction, potentially triggering behavior even when JavaScript is disabled in the viewer and enabling document manipulation (e.g., altering /Annots or /Signatures) across different PDF viewers, including lightweight mobile/embedded parsers.