The Misconception
"It's just a PDF" is one of the most dangerous assumptions in computing. PDFs are not static documents — they are a rich, scriptable container format that can carry JavaScript, embedded files, forms, fillable actions, and even other documents.
What a PDF Can Contain
| Capability | Risk Level |
|---|---|
| Text and images | Safe |
| Form fields | Mostly safe |
| JavaScript | High — can call URLs, prompt for credentials, exploit reader bugs |
| Embedded files | High — can contain executables or other documents |
| Launch actions | High — can run external applications |
| Submit-form actions | Medium — can exfiltrate filled data to remote URLs |
Most of these features exist for legitimate workflows (corporate forms, e-signatures). But each one is also an attack surface.
How PDF Malware Typically Works
- The PDF arrives — usually as an email attachment with an invoice-like name.
- The user opens it in their default PDF reader.
- An embedded script or vulnerability triggers, either:
- Downloading and running a second-stage payload, or
- Exploiting a memory-corruption bug in the reader to execute arbitrary code, or
- Displaying a phishing prompt asking for credentials.
- The actual malware is delivered, often a trojan or infostealer.
Famous PDF Vulnerabilities
PDF readers have a long history of high-impact vulnerabilities. Major reader vendors patch multiple critical vulnerabilities every year. An unpatched PDF reader is one of the easiest ways to get owned in 2026.
How to Open PDFs Safely
1. Keep Your Reader Patched
Adobe Acrobat, Foxit, browser-built-in readers — all of them. Auto-update should be enabled.
2. Use a Sandboxed Reader
Modern browsers (Chrome, Edge, Firefox, Safari) render PDFs in a heavily sandboxed engine. For untrusted PDFs, opening them in your browser is safer than opening them in a desktop reader.
3. Disable JavaScript in Your PDF Reader
In Adobe Acrobat: Preferences → JavaScript → Enable Acrobat JavaScript → uncheck.
This breaks some interactive forms, but eliminates the most common malicious capability.
4. Scan First
Upload suspicious PDFs to Virus Purge or another antivirus before opening. Signature-based detection catches most known malicious PDFs.
5. Use Protected View
Most enterprise readers offer a "Protected View" or "Trust Manager" — opening untrusted PDFs in a restricted environment that blocks scripts, network access, and embedded actions.
Red Flags Inside a PDF
If you have opened one and become suspicious:
- A prompt to enable JavaScript or click a "Trust this document" button.
- A login prompt mimicking Microsoft, Google, or DocuSign.
- A blurred-out preview with a button to "click to view".
- A button labelled "Submit" that goes to an unknown URL.
Close the document immediately and treat the machine as potentially compromised.
The Short Version
PDFs can run code. PDF readers have vulnerabilities. Treat unexpected PDFs the same way you treat unexpected executables — scan them, open them carefully, and never enable scripts unless you have a specific, verified reason to.