CVE-2026-57259

MediumCVSS 6.5

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

The vulnerability in a PDF parser allows injection of malicious external XML entities that point to local paths. An attacker can access any local files within the user's permission range.

Risk Assessment

The organization is at risk of sensitive data leakage, as an attacker can read local system files or user data.

Recommendation

Update the PDF parser to the latest version that disables external XML entity processing. Restrict application file read permissions.

Other vulnerabilities in PDF Parser

CVE-2026-57260High
The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object as a pointer and used it as a valid address, ultimately causing the application to crash.

Original NVD description (English source)

The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF will be sent to the parser. Malicious documents will construct malicious external entities that, through the protocol, point to local paths, thereby allowing access to any local files within the user's permission range.