From Documentation to Zero-day Vulnerabilities: LLM-Driven Fuzzing of JavaScript Engines in PDF Readers

2026-08-06

AI Summary

This work addresses the challenge that existing PDF fuzzer tools struggle to uncover deep vulnerabilities requiring multi-step API call sequences. The authors propose PDFuzzer, the first approach integrating large language models with constraint solvers to automatically infer API dependencies from JavaScript API documentation and execution traces. By constructing context-free grammars and generating semantically valid, high-coverage complex call sequences, PDFuzzer enables end-to-end automated vulnerability discovery—from technical documentation to zero-day exploits. Evaluated on three major PDF readers, the method achieves an average 48% increase in code coverage and uncovers 31 critical zero-day vulnerabilities, including arbitrary code execution flaws, earning acknowledgments and bug bounties from vendors.

Abstract

Existing fuzzers for PDF readers rely on simple test cases that involve only individual API calls, leading to limited coverage and potentially missing vulnerabilities that require sequences of API calls. To address these limitations, we propose PDFuzzer, a novel PDF engine fuzzer that automatically generates complex and meaningful API call sequences. PDFuzzer first uses a Large Language Model (LLM) to construct context-free grammars and infer the relationships between individual API calls from specifications extracted from JavaScript API manuals and execution traces. Based on the grammars and relationships, PDFuzzer employs a constraint solver to generate concrete API call sequences for fuzzing. Our experiments show that PDFuzzer significantly outperforms state-of-the-art PDF fuzzers (TypeOracle, Favocado, and Cooper) and LLM-based fuzzers (Fuzz4All, naive LLM) on three mainstream PDF readers: Adobe Acrobat Reader, Foxit PDF Reader, and PDF-XChange Editor. PDFuzzer achieves up to 48% higher coverage than existing tools and identifies 31 zero-day vulnerabilities in these readers, from information leakage to arbitrary code execution. Our ablation study validates the necessity of each component, including LLMs, which achieve high accuracy across all pipeline stages (93-98%). We disclosed all vulnerabilities to the vendors via a coordinated vulnerability disclosure process and received bug bounties.

Problem

• PDF readers
• fuzzing
• zero-day vulnerabilities
• JavaScript engines
• API call sequences

Innovation

• LLM-driven fuzzing
• API call sequences
• PDF reader security
• zero-day vulnerability discovery
• constraint-based test generation