Loading story…
A null pointer dereference vulnerability tracked as CVE-2019-9589 affects Xpdf 4.01 in the function PSOutputDev::setupResources() within PSOutputDev.cc. The flaw can be triggered when the pdftops binary processes a crafted PDF file, causing a segmentation fault and resulting in a denial-of-service condition. The issue was reported by the ACE Team at Loginsoft, which published debugger output, source-code context, and a proof-of-concept demonstrating the crash path.
The disclosure notes indicate the vendor was notified before public release, and the affected software is distributed through the Xpdf project’s download channel. Organizations using Xpdf, especially workflows that automatically convert untrusted PDF files with pdftops, face a risk of service interruption and should verify whether vulnerable 4.01 deployments remain in use and apply an updated version or compensating controls where available.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
The Xpdf 4.01 null pointer dereference vulnerability in PSOutputDev::setupResources() was publicly disclosed. The flaw could cause a denial of service through a segmentation fault when pdftops processed a crafted PDF file.
ACE Team at Loginsoft disclosed the null pointer dereference vulnerability later assigned CVE-2019-9589 to the vendor. The issue affected Xpdf 4.01 and could be triggered via a crafted PDF processed by pdftops.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple previously unknown weaknesses across the PDF ecosystem that can be exploited through crafted documents. Novee Security’s research into *Foxit* and *Apryse* PDF platforms described **13 vulnerability categories** and **16 exploit paths**, including **critical XSS** and **OS command injection**, with “one-click” scenarios where simply opening a document could trigger compromise and potentially enable account takeover or backend command execution. Separately, a high-severity flaw in the widely used *jsPDF* library was disclosed as **CVE-2026-25755** (CVSS **8.8**), enabling **PDF object injection** via improper sanitization in the `addJS` method. By breaking out of the `/JS (...)` string (e.g., injecting `) >> /Action ...`), an attacker can inject arbitrary PDF structures and actions such as `/OpenAction`, potentially triggering behavior even when JavaScript is disabled in the viewer and enabling document manipulation (e.g., altering `/Annots` or `/Signatures`) across different PDF viewers, including lightweight mobile/embedded parsers.
Jun 29, 2026
Researchers at **Novee** reported **16 vulnerabilities** affecting widely deployed PDF platforms **Apryse WebViewer** (formerly PDFTron) and **Foxit PDF cloud services/SDK components**, warning they could be exploited for **account hijacking, data theft, and in some cases remote code execution**. Reported issue classes include **DOM-based, stored, and reflected XSS**, **server-side request forgery (SSRF)**, **path traversal**, and **OS command injection**; testing indicated attackers could trigger exploitation via **crafted documents, messages, or URLs**, with elevated risk when these viewers are embedded inside **authenticated enterprise applications** and trusted domains. Technical details highlighted that Apryse WebViewer spans multiple trust boundaries (a React-based iframe UI ingesting untrusted inputs such as query strings and `postMessage`, a JavaScript/WebAssembly document engine, and server-side SDK services), and that insufficient validation across these boundaries enabled exploitation paths. The most severe issue described was a **critical OS command injection (CVSS 9.8)** in Foxit’s Node.js signature server component, where a POST body parameter was reportedly concatenated into a command execution path. Both **Apryse** and **Foxit** stated the findings were **responsibly disclosed** and addressed via **patches, updates, and configuration changes**, with additional security hardening performed during remediation.
Jun 29, 2026
Adobe patched two out-of-bounds read vulnerabilities in **Adobe Reader DC** affecting version `2019.010.20099`, both tied to the `2d.x3d!_LoadTIFF()` processing path used to render embedded **U3D** 3D content inside PDF files. Tracked as `CVE-2019-8010` and `CVE-2019-8011`, the flaws can be triggered by a crafted PDF containing malformed external texture references in embedded 3D objects, causing the sandboxed Reader process to crash under the logged-on user context. The bugs affect Acrobat’s handling of ECMA-363 Universal 3D File Format resources, including external image and texture parsing such as PNG- and TIFF-related paths. The issue is not reachable in a default installation unless 3D content display is enabled, but it poses greater risk in environments that routinely exchange 3D PDFs, including CAD-heavy workflows where 3D viewing may be enabled by default. Adobe addressed both issues in advisory **`APSB19-41`** after coordinated disclosure by STAR Labs.
Jun 29, 2026