People think of a PDF as a finished, inert page. In reality, the format can carry scripts, embedded files and interactive content — which means a PDF can, in the right circumstances, deliver malware.
How a PDF can carry a threat
A PDF is not just text and images. It can include several active elements:
- JavaScript: forms can run scripts for calculations — but malicious scripts can exploit viewer vulnerabilities.
- Embedded files: a PDF can carry other files inside it, including executables disguised as harmless attachments.
- Launch actions: older specs allowed a PDF to try to open external programs.
- Links: phishing links inside a convincing-looking document.
What is not a threat
The text and images in a PDF cannot, by themselves, infect your device. Opening a PDF and reading it is safe in a modern, patched viewer. The risks come from the active parts.
The page itself is safe. The danger is what the page is allowed to do.
How to stay safe
- Keep your PDF reader updated — most attacks target old vulnerabilities.
- Disable JavaScript in your reader if you do not need it.
- Do not open PDFs from unknown senders, especially with unexpected attachments.
- Be wary of a PDF that asks you to enable content or run a file.
- Scan suspicious files with your security software.
Sending PDFs safely
If you are sharing finished documents, you can reduce risk by removing active content and protecting files with a password. SELKATDocs can add password protection to your PDFs so only the right people can open them.
Try the SELKATDocs Protect PDF tool →
A little caution goes a long way — the format is safe when you treat it with the same care as any file.