VULNERABILITY INTELLIGENCE

CVE-2026-12057

CVSS score8.6 HIGH
EPSS probability0.13%
CISA KEVNot currently listed
Published2026-06-15
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Description

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.

Weakness classification

  • CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Primary references