Code Injection in PDF.js - CVE-2026-16633
Published: July 29, 2026
Vulnerability identifier: #VU139959
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2026-16633
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
PDF.js
PDF.js
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary JavaScript in the context of the hosting domain.
The vulnerability exists due to improper neutralization of active content in PDF scripting support in PDF.js when processing a malicious PDF with scripting enabled. A remote attacker can supply a specially crafted PDF to execute arbitrary JavaScript in the context of the hosting domain.
Exploitation requires the application to load the crafted PDF with enableScripting set to true and without a content security policy that disallows script sources.
How to mitigate CVE-2026-16633
Install security update from vendor's website.