Yes, a PDF can carry malware, though it doesn't work the way people usually picture it. A PDF isn't a program, so it can't run on its own. What it can do is hold JavaScript, links, embedded files and actions that fire when the file opens, and use them to exploit a bug in your PDF reader or trick you into clicking through to something nasty. Most attacks today are the second kind: phishing PDFs with a fake "View document" button. Here's what's actually possible, how to check a suspicious file, and how to clean a PDF before you pass it on.
The PDF format is more than pages of text and pictures. The specification lets a file include several kinds of active content, and each one is a possible way in:
| PDF keyword | What it does | Why attackers use it |
|---|---|---|
| /JavaScript, /JS | Runs scripts in readers that support them (Acrobat and Reader do) | Most classic Reader exploits needed JavaScript to set up memory before triggering a bug |
| /OpenAction, /AA | Runs an action automatically when the file or a page opens | Fires the payload without a single click |
| /Launch | Asks the reader to start another program or open a file | Can start a command line; modern readers show a warning first |
| /EmbeddedFile | Attaches any file inside the PDF | Smuggles an .exe, script or Office macro document past email filters |
| /URI | An ordinary web link | Phishing: a big "Download invoice" button pointing to a fake login page |
| /AcroForm, /XFA | Interactive forms | XFA in particular brings a large, bug-prone code path |
| /JBIG2Decode, /RichMedia | Image compression and embedded Flash or media | Historically home to several reader memory bugs |
None of these is malicious by itself. Plenty of tax forms use JavaScript to add up boxes, and links are everywhere. A file that has several of them together, especially /OpenAction plus /JavaScript plus an embedded file, is the pattern security analysts look for.
It's possible, but rare, and it depends heavily on your reader. A "just open it" infection needs an unpatched vulnerability in the program showing the file. Those do exist. In 2018, researchers at ESET found a malicious PDF that chained an Adobe Reader bug (CVE-2018-4990) with a Windows privilege escalation bug (CVE-2018-8120). In 2024, a flaw in PDF.js, the viewer built into Firefox and used by thousands of websites, let a crafted PDF run JavaScript in the page that displayed it (CVE-2024-4367, fixed in Firefox 126).
Bugs like these get patched quickly, and they're expensive, so they tend to be used against specific targets, not sprayed at the public. For most people the realistic risk is a PDF that looks like a document but is really a lure: it asks you to click a link, "enable content" or open an attached file. The PDF is just the envelope; you're the one who opens the door.
Browser viewers are a safer place to open unknown PDFs than desktop Acrobat with JavaScript on. Chrome, Edge and Firefox render PDFs inside their sandbox and support only a small slice of PDF scripting. Keeping your browser and reader updated matters more than which one you pick.
Get-FileHash in Windows PowerShell, shasum -a 256 on a Mac, sha256sum on Linux), then search that hash on VirusTotal. If the file is already known, you'll see verdicts from dozens of antivirus engines without uploading anything. Before uploading the file itself, read whether it's safe to upload files to VirusTotal. Uploads are shared with security vendors, so never upload anything confidential.One caution: don't use any web tool, ours included, as a safety test for a PDF you think is hostile. A browser-based tool opens the file in your browser, which is the very thing you're trying to avoid. For a truly suspicious file, use Dangerzone, the free tool from the Freedom of the Press Foundation that converts documents to safe images inside a disposable container, or open it in a virtual machine.
Sometimes, and it's worth knowing which parts. Most PDF editors (including our split, merge and page tools, which use the pdf-lib library) build a fresh document and copy pages into it. We tested exactly what survives that by making a PDF loaded with every active feature, then copying its pages into a new file with pdf-lib, the same way those tools do:
| Active content in the original | After copying pages into a new PDF | After rasterizing (flatten to images) |
|---|---|---|
| /OpenAction script (runs on open) | Removed | Removed |
| Document-level JavaScript (/Names tree) | Removed | Removed |
| Embedded file attachment | Removed | Removed |
| Page-level action (/AA script on page open) | Kept | Removed |
| /Launch link annotation | Kept | Removed |
| Ordinary web links (/URI) | Kept | Removed |
So splitting or merging strips the file-level tricks but not the ones attached to individual pages. Rasterizing is the thorough option: every page becomes a picture, and a picture can't run anything. That's the idea behind Dangerzone, and it's what the "Everything" mode in our Flatten PDF tool does with a file you already trust but want to clean before forwarding. The cost is that text stops being selectable, so run OCR afterward if you need it searchable.
Don't panic. If you only viewed it in an updated browser and didn't click anything inside, the odds of harm are low. If you clicked a link and typed a password, change that password now, starting with your email account, and turn on two-factor authentication. If you opened an attachment from inside the PDF or allowed something to run, disconnect from the network, run a full scan with your antivirus (Microsoft Defender is fine on Windows), and if it's a work device, tell your IT team right away. They'd much rather hear about it in five minutes than find out in five weeks.
For more on handling documents safely, see whether it's safe to upload PDFs to online tools.
Yes. A PDF can contain JavaScript, automatic actions, embedded files and links that are used to exploit reader bugs or lead you to malware. The most common malicious PDFs today are phishing lures that ask you to click a link rather than true exploits.
It's possible if your PDF reader has an unpatched security bug, but uncommon. Keeping your browser and PDF reader updated, and opening unknown PDFs in a browser instead of a desktop reader with JavaScript enabled, removes most of the risk.
Be wary of unexpected files, check the file's SHA-256 hash on VirusTotal, inspect it with a tool like pdfid for JavaScript, automatic actions and embedded files, and check any link before clicking it.
Yes, rasterizing every page to an image removes scripts, actions, embedded files and links. Do it in an isolated tool like Dangerzone for files you think are hostile, since the conversion itself has to open the file.
Generally yes. Chrome, Edge and Firefox open PDFs inside the browser sandbox and support far less PDF scripting than Adobe Acrobat, which leaves less for an attacker to work with. Updates still matter, since browser PDF viewers have had bugs too.