> PDFs are executables, that's why it's hard.

That isn’t really true, it’s not hard for PDF viewers to block by default (or just not implement) the problematic features, which also aren’t critical for the vast majority of PDF files.

The exploitable bugs are typically the usual, some buffer overflow in an underlying image or font library or similar, but unrelated to PDFs being “executable”.

▲

pishpash 7 hours ago | parent [-]

What a sleight of hand. PDF's are obviously not executable, any more than text files are. Decoders are executable and they can choose to unsafely handle input. Even plain text editors can have exploits. It's no different than any piece of complex software.

▲

layer8 7 hours ago | parent [-]

The characterization of the PDF format specifically being “basically code” in any substantial manner is simply incorrect. The only PDF-specific features that reasonably meet that description is the PostScript support, which has fallen out of use decades ago and was completely removed in PDF 2.0, and the JavaScript support, which is optional, prohibited in PDF/A, and can easily be limited or omitted by a PDF viewer.

▲

jwilk 6 hours ago | parent [-]

> the PostScript support

What do you mean by that?

	▲	0x457 4 hours ago \| parent [-]
		Older PDFs support PostScript XObjects: literal embedded PostScript code. Not sure it counts tho, because IIRC it was never executed by PDF viewer itself. It was "gives this to printer when printing"