CVE-2026-84852: Reader Tools PDF Reader App File ActSplashNew.handleDeeplink path traversal
A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running Reader Tools PDF Reader App version 98.8 on Android are identified as affected. Exploitation requires local access, so it is not described as remotely reachable over the network.
What access does an attacker need?
The vulnerability has an attack vector of local and requires low privileges. No user interaction is required according to the supplied vector.
What is the potential impact of successful exploitation?
Successful manipulation of the _display_name argument in the File Handler deeplink path can cause path traversal. The reported impact includes low integrity and availability impact, with no reported confidentiality impact.
What should teams do if they cannot patch immediately?
The provided data does not identify a workaround or fixed version. Prioritize limiting untrusted local access and review use of deeplinks that can supply the _display_name argument.
How likely is exploitation?
The exploit has been publicly disclosed and may be used. The supplied vector rates exploit maturity as proof-of-concept.