CVE-2026-57241
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The vulnerability in a PDF viewing application occurs when JavaScript performs operations on the page and document, causing page-related objects to lose synchronization. The renderer still trusts the outdated page count, leading to out-of-bounds access and application crash.
Risk Assessment
The risk involves a potential denial of service (DoS) attack where a malicious PDF file can intentionally crash the application, disrupting user operations.
Recommendation
It is recommended to update the application to the latest version that includes a fix for page object synchronization and validates the page count before rendering.
Original NVD description (English source)
The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the application to lose synchronization; however, the renderer still trusts the outdated page count, and eventually the application crashes due to out-of-bounds access.