syslog.eu
CS EN DE FR
[WARNING · CHECK THIS WEEK]/News·

AES-256 PDFs from MuPDF < 1.28.5 and one Foxit build open without the password: update MuPDF

Researchers at v12.sh showed on 28 October that several PDF programs and libraries generate the AES-256 file key from randomness so limited it can be guessed. The key falls in milliseconds for MuPDF before 1.28.5 and, for recent files, Foxit PDF Reader build 2026.1.3.36551. Decryptors for both are public. The researchers told the vendors; a fix is reported only for MuPDF.

Affected foxit-pdf-reader itext mupdf openpdf

Does this concern you?

  • Affected: companies whose password-protected payslips, contracts or reports are encrypted with AES-256 by MuPDF before 1.28.5, that Foxit build, or, on weaker evidence, the Java libraries OpenPDF 3.0.5 or iText 9.7.1.
  • Skip it if: nobody in your company relies on PDF passwords.

What to do

  • Find out which program adds the password: the "PDF Producer" field in a sent file's document properties usually names the program or library that wrote the file, not always the one that encrypted it. For payroll software, ask the supplier in writing which library encrypts.
  • MuPDF: move to 1.28.5 or newer, also in tools that embed it.
  • Foxit build, OpenPDF, iText: the article mentions no fix. Until the vendor confirms one, send documents that matter through a channel with personal logins, not just a password-protected PDF.
  • Don't: expect an update to rescue copies already out. If a file encrypted by that Foxit build or MuPDF before 1.28.5 held something sensitive, assume anyone holding it can read it.

What we know – and what we don't

  • In AES-256 PDF encryption, a random 32-byte file key locks the content; the password only protects that key. Guess the key and no password is needed, however long.
  • MuPDF before 1.28.5: 9 bits of random state reach the key, leaving 512 candidates. Unoptimised Python tried them all in roughly 11 milliseconds.
  • The Foxit build hashes the current time, 32 bytes that are zero in practice and a constant; the researchers check 370 to 376 million timestamps per second.
  • OpenPDF 3.0.5 and iText 9.7.1 seed the key with a millisecond timestamp and the Java runtime's free memory. That varies more, but the researchers say it still undermines the 256-bit promise. They published no decryptor for these two.
  • The Foxit-style derivation was already in PDFium's first public commit (May 2014); other editors may have inherited it.
  • Open: whether Foxit, OpenPDF or iText will fix it, and whether other versions or tools are affected. The article mentions no use against real files.

Why it matters

For many small companies, a PDF password is the whole protection for payslips and contracts. With MuPDF before 1.28.5 and that Foxit build, it is closer to decoration. In our view, this week's useful step is learning which program encrypts: that decides between an update and questions for a supplier.

Sources

← All news