CVE-2026-114491 bpampuch CVE debrief

Who should care

Defenders responsible for systems handling user-supplied documents, especially those using pdfmake 0.3.8 before 0.3.12, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-114491 allows attackers to bypass local file policy restrictions in pdfmake 0.3.8 before 0.3.12, potentially leading to unauthorized file access and data exposure. Defenders should prioritize verifying pdfmake versions, assessing exposure in document processing systems, and implementing compensating controls to restrict access to sensitive local files. Evidence is based on official CVE and source item records, with some limitations in scope and impact details.

• Read access to blocked local files
• Potential data exposure through generated PDFs
• Need for version verification and upgrade
• Possible impact on document processing workflows

Technical summary

The pdfmake library fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files by supplying a document definition with an SVG image href pointing to a local path. This vulnerability affects pdfmake versions 0.3.8 and earlier, and has been addressed in version 0.3.12. Defenders should prioritize verifying pdfmake versions and assessing exposure, especially in systems handling user-supplied documents. Attackers can exploit this vulnerability to embed restricted file contents in generated PDFs.

Defensive priority

Defenders should prioritize verifying pdfmake versions and assessing exposure, especially in systems handling user-supplied documents.

Recommended defensive actions

• Verify pdfmake version and upgrade to 0.3.12 if possible
• Assess exposure in systems handling user-supplied documents
• Implement compensating controls to restrict access to sensitive local files
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability in pdfmake 0.3.8 before 0.3.12, where the setLocalAccessPolicy() restriction is not applied to images referenced inside SVG content, allowing attackers to read blocked local files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.