CVE-2026-13127
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The vulnerability occurs when the application opens a PDF file, and JavaScript rewrites the document, modifying the page structure and invalidating page objects. Thumbnails still use these invalid objects, ultimately causing the application to crash.
Risk Assessment
The risk involves the possibility of intentionally crashing the application by opening a crafted PDF file, which can lead to user workflow interruption and potential loss of unsaved data.
Recommendation
It is recommended to update the application to the latest version that includes a fix preventing thumbnails from using invalidated page objects. If no patch is available, restrict opening PDF files from untrusted sources.
Other vulnerabilities in PDF Viewer
See all- CVE-2026-57252High
When opening a PDF file, during JavaScript-based deletion of pages and attachment annotations, the attachment panel accesses invalid pointers, causing the application to crash.
- CVE-2026-57250High
The vulnerability in a PDF viewing application occurs when JavaScript resets form fields, causing re-entry into the interface and damaging the native object. The application fails to validate the object before calling a function, leading to a crash.
- CVE-2026-57242High
The vulnerability in the PDF viewing application stems from incomplete lifecycle management and null value validation of objects. JavaScript modifies the form, and when the page state changes, the application repeatedly dereferences invalid objects, eventually causing a crash.
- CVE-2026-57241Medium
The vulnerability in a PDF viewing application occurs when JavaScript performs operations on the page and document, causing page-related objects to lose synchronization. The renderer still trusts the outdated page count, leading to out-of-bounds access and application crash.
- CVE-2026-57237High
The vulnerability in the PDF viewing application occurs when JavaScript modifies form field properties, causing the state of underlying objects referenced by the program to become invalid. This eventually leads to reading an illegal memory address and crashing the application.
- CVE-2026-13128High
Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.
Original NVD description (English source)
The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnails still use the invalid page objects, ultimately causing the application to crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS