OPEN LINK ↗
// 1h agoSECURITY INCIDENT
V12 Exposes 9-Bit PDF AES Keys
V12 found that MuPDF, Foxit, OpenPDF, and iText generate supposedly AES-256 PDF keys from tiny or predictable random states, enabling passwordless decryption. Public decryptors are available, while existing vulnerable PDFs remain exposed.
// ANALYSIS
AES-256 did not fail—the entropy plumbing did. This is a sharp reminder that cryptographic strength depends on key generation, not algorithm labels.
- –MuPDF reduces key recovery to just 512 candidates through 9 bits of effective state.
- –Foxit uses time-based and uninitialized data; OpenPDF and iText rely on timestamp- and memory-derived ARC4 seeds.
- –Public decryptors make the weaknesses practical rather than theoretical.
- –Updating software protects new PDFs, but old files must be reissued because weak keys cannot be retroactively repaired.
// TAGS
v12securityopen-sourcetestingresearch
DISCOVERED
1h ago
2026-10-29
PUBLISHED
5h ago
2026-10-28
RELEVANCE
6/ 10
AUTHOR
ledoge