SecurityLobstersabout 1 hour ago
PDF Editors Flaw Exposes AES-256 Keys
5 min read
Researchers found that MuPDF, Foxit, OpenPDF, and iText generate insecure AES-256 keys from limited random states. MuPDF versions before 1.28.5 rely on nine bits of timestamp state, while Foxit 2026.1.3.36551 uses uninitialized bytes. These flaws allow passwordless decryption of protected documents within milliseconds on modern hardware.
Level
Hype check
Tap to vote and see what everyone thinks.