Can a PDF contain malware?

An invoice arrives from a supplier you recognise. It's a PDF, and everyone knows PDFs are just documents — the safe thing you convert files into so nothing can go wrong. That belief is why "invoice.pdf" remains one of the most reliable ways to get someone to open an attachment. The honest answer is more nuanced than yes or no, and the nuance is what makes it useful.

The short answer

A PDF is not an executable. Opening one does not run a program the way double-clicking an .exe does. But a PDF is not inert either. The format supports active content, and a malicious file generally works in one of three ways: it convinces you to click something, it carries something else inside it, or it deliberately malforms itself to attack a bug in whatever opens it.

The short version: the format allows more than people assume, but in practice most malicious PDFs don't exploit anything clever — they just contain a convincing link. Your judgement matters more than your scanner.

What a PDF can actually contain

Beyond text and images, the specification permits a number of things that surprise people:

JavaScript. Yes, really. PDFs can embed scripts, which is how order forms total a column or validate a date before you submit. It's a legitimate feature with an entirely legitimate history.
Actions that fire automatically. A document can declare an action to run when it opens, when a page is displayed, or when the mouse enters a region. Combined with scripting, that means a file can do something before you've knowingly interacted with it at all.
Embedded files. A PDF can carry arbitrary attachments inside it — a spreadsheet, an archive, an executable. The PDF becomes a container: harmless while it sits there, harmful if a user is talked into extracting and running it.
Links and launch actions. A link can open a URL. A launch action asks the reader to open an external application. Modern readers block or heavily warn on the latter, but the intent lives in the file.
Forms that submit data. A form can be configured to post what you type to a remote address.

None of these are exotic hacks. They're documented features, used every day by ordinary business documents. That's precisely what makes their presence ambiguous rather than damning.

The realistic risk model

It's worth separating what's theoretically possible from what actually happens, because the gap between them is where bad advice lives.

Social engineering — by far the most common. The PDF is a perfectly valid document containing a link to a convincing fake login page, or an "enable content to view invoice" instruction. Nothing in the file is technically malicious. It's a delivery vehicle for a lie, and no scanner reliably catches a lie.
Reader vulnerabilities — real, rarer, more serious. PDF parsers are enormous pieces of software handling a complicated format. A deliberately malformed file can trigger a bug and, in the worst case, run code. This is what "a PDF gave me a virus" usually means — and it's why an outdated reader is the actual liability.
Carrier files. The PDF holds an attachment that does the damage once extracted and run. The PDF itself never does anything untoward.

Notice what's not on that list: a PDF quietly infecting a modern, patched, sandboxed viewer just by being displayed. That's not impossible, but it's a serious exploit, not the daily reality of your inbox.

Why "don't open suspicious PDFs" is useless advice

Plenty of people open PDFs from strangers as their actual job. Accounts payable receives invoices from unknown senders. Recruiters open CVs. Support teams open customer attachments. Telling them not to is telling them not to work. The useful question isn't "should I open this?" but "what is in this file, and does it match what it claims to be?" — a question you can actually answer.

How to inspect a PDF before you trust it

You can check what a document contains without opening it in a full-featured reader, and without handing a possibly-malicious file to a third-party service:

Check for scripts. Open Detect JavaScript and load the file. It reports whether the document carries embedded JavaScript.
Check for attachments. Open Detect Embedded Files to see whether anything is packed inside the PDF.
Compare against expectations. A supplier invoice with an embedded archive and an auto-run script is not a normal invoice. An interactive form from your accountant containing JavaScript probably is.
Escalate, don't improvise. If something is present that shouldn't be, that's an IT conversation — not a "let's see what happens" moment.

Open the Detect JavaScript tool

Finding JavaScript doesn't mean it's malicious

This matters, because a detector that makes you panic is worse than no detector. Embedded JavaScript is normal in interactive forms: tax forms, application forms, expense claims, anything that calculates or validates as you type. Finding a script tells you the document is interactive, not that it's hostile.

What the signal gives you is context to weigh. Ask whether active content belongs in this document from this sender. A government form with a script: unremarkable. A one-page "receipt" from a courier you've never used, carrying a script and an embedded executable: that combination tells its own story.

The limits of any inspection

Being straight about this is more useful than overselling the tools:

This is not antivirus. Detection reports structure — what the file contains. It doesn't judge intent and doesn't match known malware signatures.
A clean report is not proof of safety. The most effective malicious PDFs contain no scripts and no attachments. They contain a link and a plausible story. Nothing to detect.
It can't tell you a link is a phishing site. A URL is a URL, whether it points to your bank or a convincing copy.

Inspection narrows uncertainty. It doesn't eliminate it, and any tool claiming otherwise is selling something.

Practical habits that actually help

Keep your reader updated. This is the single highest-value habit here. Nearly every "PDF exploit" story is a patched bug meeting an unpatched machine.
Prefer a sandboxed viewer. Modern browsers render PDFs in a heavily restricted environment with very limited scripting. That's a meaningful safety margin over a full-featured desktop reader with every feature enabled.
Turn off JavaScript in your PDF reader if you never fill in interactive forms. It costs you nothing and removes a whole category of risk.
Treat "enable" prompts as a stop sign. Legitimate documents rarely need you to override a security warning to read them.
Verify out of band. If an invoice looks off, phone the supplier on a number you already had — not one printed in the document.

Why inspect locally?

If you suspect a file is malicious, uploading it to an unknown web service is a strange first move: you've now given a copy of a possibly-sensitive document — an invoice with your banking details, a CV with someone's address — to a third party, in order to be told whether it's dangerous. Inspecting it on your own device keeps the question and the file in the same place. In CyvoDocOps, supported checks of this kind run locally in your browser and the document is not uploaded to a server.

Frequently asked questions

Can a PDF infect my computer just by being opened?

With a modern, patched, sandboxed reader this is unlikely but not impossible — it requires a genuine vulnerability. The realistic risk is a link that leads you somewhere convincing, or an attachment you're persuaded to extract and run.

Is JavaScript in a PDF always bad?

No. It's a standard feature of interactive forms, used for calculation and validation. Its presence is context, not a verdict.

Does converting a PDF to images make it safe?

Rasterising a document discards scripts, attachments and actions, so it does remove active content. It also discards selectable text, so it's a real trade — and it doesn't protect you if the original file's goal was simply to show you a convincing link.

Are these tools a replacement for antivirus?

No. They report what a PDF structurally contains. They don't identify known malware or assess intent. Use them to inform judgement, alongside a patched reader and normal caution.

Does the file get uploaded to be checked?

No. For these tools the PDF is inspected locally in your browser and is not sent to a server.