CVE-2026-13126

HighCVSS 7.8

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

Embedded JavaScript in a PDF file deleted pages, invalidating the object. The application attempted a write operation on invalid pop-up annotations, causing a crash.

Risk Assessment

An attacker can crash the application by opening a specially crafted PDF file, leading to a denial of service.

Recommendation

Update the library or application to a version that properly handles invalidated PDF objects. If no patch is available, consider disabling JavaScript support in PDF.

Original NVD description (English source)

The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up annotations, resulting in the program crashing.