PDF is Broken: a justCTF Challenge
Summary: Trail of Bits engineers designed a justCTF challenge, 'PDF is broken, and so is this file,' in which a PDF is also a working Ruby script and a valid ZIP file. The challenge's bundled mutool binary was modified to accept ACK (0x06) as a seventh whitespace character, and the flag sits in a second version of PDF object 0x1337 encoded with Flate, ASCIIHex, and DCT filters.
Bottom line: The file format is a container that can carry arbitrary encoded blobs which never affect rendering, and most viewers will show a broken PDF as a blank page without complaint - so a file that opens cleanly tells you nothing about what else it holds.
Read the original at Trail of Bits Blog ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026