Researchers Report 31 PDF Reader Zero-Days Found by PDFuzzer
Researchers introduced PDFuzzer in an August 6 paper accepted to ACM CCS 2026, using an LLM and constraint solving to generate JavaScript API-call sequences for PDF-reader fuzzing. The authors report up to 48% greater coverage than comparison systems and 31 previously unknown vulnerabilities across Adobe Acrobat Reader, Foxit PDF Reader, and PDF-XChange Editor, all disclosed to vendors.
Researchers have introduced PDFuzzer, a system that uses a large language model and a constraint solver to generate complex JavaScript API-call sequences for testing PDF readers. The paper was submitted to arXiv on August 6, 2026, and the authors state that it has been accepted to ACM CCS 2026.
The team evaluated PDFuzzer against Adobe Acrobat Reader, Foxit PDF Reader, and PDF-XChange Editor. In the paper, the authors report that the system found 31 previously unknown vulnerabilities, ranging from information disclosure to arbitrary code execution, and achieved up to 48% more coverage than the comparison fuzzers. They say the vulnerabilities were disclosed to the vendors through coordinated disclosure and resulted in bug bounties.
How PDFuzzer builds test cases
Many PDF-reader fuzzers test individual JavaScript API calls. PDFuzzer instead tries to construct longer, meaningful call sequences that can reach program states a one-call test may miss. It extracts specifications from JavaScript API manuals and combines them with execution traces.
The LLM then produces context-free grammars and infers relationships among API calls. A constraint solver converts those structures into concrete sequences for fuzzing. The authors compare PDFuzzer with TypeOracle, Favocado, Cooper, Fuzz4All, and a direct LLM baseline, and report LLM accuracy of 93% to 98% across the pipeline stages examined in their ablation study.
What the result does and does not establish
The reported vulnerability count and coverage gain come from the research team. The retrieved author-maintained publication list independently confirms the paper's authorship and ACM CCS placement, but this audit did not identify a separate replication of the experiments. The paper also does not provide public vulnerability identifiers or patch-status details on the abstract page, so the findings should not be treated as a complete operational advisory for any specific PDF-reader version.
For application-security teams, the practical lesson is methodological. API documentation can give an LLM enough structure to propose stateful tests, while constraint solving keeps generated sequences consistent with the inferred relationships. That combination may expand coverage where naive LLM prompting or single-call fuzzing stalls. Production adoption would still require reproducible test artifacts, version-specific triage, safe handling of generated crashes, and coordination with affected vendors.
Key Points
- 1PDFuzzer combines LLM-generated API grammars with constraint solving to produce stateful JavaScript test sequences for PDF readers.
- 2The authors report up to 48% higher coverage and 31 previously unknown vulnerabilities across three mainstream PDF readers.
- 3The paper is accepted to ACM CCS 2026, but its benchmark and vulnerability results remain author-reported without an independent replication identified in this audit.
Scoring Rationale
The work reports a substantial set of responsibly disclosed PDF-reader vulnerabilities and a concrete LLM-assisted fuzzing method, while the absence of public vulnerability identifiers and independent replication constrains operational certainty.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
