Author: msahyoun Date: Thu May 28 19:16:04 2026 New Revision: 1934732 Log: PDFBOX-6208: clarify sandbox is not a PDFBox provided one
Modified: pdfbox/trunk/SECURITY.md Modified: pdfbox/trunk/SECURITY.md ============================================================================== --- pdfbox/trunk/SECURITY.md Thu May 28 19:11:27 2026 (r1934731) +++ pdfbox/trunk/SECURITY.md Thu May 28 19:16:04 2026 (r1934732) @@ -21,10 +21,11 @@ PDFBox supports processing of untrusted PDF files **to a limited degree**: - **In scope**: Remote code execution, privilege escalation, unauthorized data - access, sandbox escape, or disproportionate resource amplification (i.e. - small attacker-controlled inputs triggering catastrophic memory or CPU - consumption) caused by processing an untrusted PDF document. These are - genuine vulnerabilities and should be reported privately. + access, escape from an embedding application's sandbox or security boundary, + or disproportionate resource amplification (i.e. small attacker-controlled + inputs triggering catastrophic memory or CPU consumption) caused by processing + an untrusted PDF document. These are genuine vulnerabilities and should be + reported privately. - **Known limitations (not vulnerabilities)**: Malformed PDFs may cause unchecked exceptions such as `NullPointerException` or `StackOverflowError`,
