Top 10 winner
CVE-2024-4367 - Arbitrary JavaScript execution in PDF.js
PDF.js compiles each glyph's drawing commands into a JavaScript function body and inserts the font matrix values unquoted, but a PDF font dictionary can supply its own matrix holding a string instead of numbers. Merely opening a crafted PDF runs arbitrary JavaScript, as XSS in sites embedding the library and as native code execution in unsandboxed Electron apps.
Record
- Researcher
- Thomas Rinsma
- Published by
- codeanlabs
- Date
- Format
- Advisory
- Topic
- Server
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Thomas Rinsma, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .