CVE-2026-57245
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
When opening a PDF, the application fails to validate abnormal annotation relationships and field combinations related to hyperlinks, causing internal objects to enter an invalid state. During destruction, an invalid pointer write occurs, crashing the application.
Risk Assessment
An attacker can craft a malicious PDF that, when opened, crashes the application, resulting in a denial of service (DoS) for the user.
Recommendation
Immediately update the library or application to a version that includes a fix for hyperlink annotation validation in PDF files.
Other vulnerabilities in PDF library
See all- CVE-2026-57254High
There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to perform proper type checking, ultimately causing the application to crash.
- CVE-2026-13126High
Embedded JavaScript in a PDF file deleted pages, invalidating the object. The application attempted a write operation on invalid pop-up annotations, causing a crash.
Original NVD description (English source)
When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an invalid pointer write occurred, causing the application to crash.