CVE-2026-13126
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Embedded JavaScript in a PDF file deleted pages, invalidating the object. The application attempted a write operation on invalid pop-up annotations, causing a crash.
Risk Assessment
An attacker can crash the application by opening a specially crafted PDF file, leading to a denial of service.
Recommendation
Update the library or application to a version that properly handles invalidated PDF objects. If no patch is available, consider disabling JavaScript support in PDF.
Other vulnerabilities in PDF Library
See all- CVE-2026-57254High
There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to perform proper type checking, ultimately causing the application to crash.
- CVE-2026-57245High
When opening a PDF, the application fails to validate abnormal annotation relationships and field combinations related to hyperlinks, causing internal objects to enter an invalid state. During destruction, an invalid pointer write occurs, crashing the application.
Original NVD description (English source)
The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS