CVE-2026-84852: Reader Tools PDF Android Path Traversal

CVE-2026-84852 Overview

CVE-2026-84852 is a path traversal vulnerability [CWE-22] in Reader Tools PDF Reader App version 98.8 for Android. The flaw resides in the ActSplashNew.handleDeeplink function within the File Handler component. Attackers can manipulate the _display_name argument to traverse directories outside the intended path. Exploitation requires local access to the affected device.

The exploit has been disclosed publicly, though no active exploitation has been reported. The vendor was contacted before disclosure but did not respond. No patch is currently available.

Critical Impact
Local attackers can leverage crafted deeplinks to read or write files outside the application's intended directory scope, potentially exposing user data stored on the Android device.

Affected Products

Reader Tools PDF Reader App version 98.8
Android platform installations of the affected app
File Handler component processing deeplinks

Discovery Timeline

2026-09-02 - CVE-2026-84852 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84852

Vulnerability Analysis

The vulnerability exists in the ActSplashNew.handleDeeplink method of Reader Tools PDF Reader App 98.8. When the application receives a deeplink, it processes the _display_name parameter without adequate sanitization. This allows an attacker to inject directory traversal sequences that escape the application's sandboxed storage area.

Path traversal issues on Android are commonly abused through Intent-based attacks. A malicious application or a crafted URI can pass traversal payloads such as ../ sequences through the deeplink handler. The receiving app then uses that value to construct file paths, resulting in reads or writes to unintended locations within the app's accessible storage.

Root Cause

The root cause is missing input validation on the _display_name argument. The handleDeeplink function trusts the value supplied by the caller and does not normalize or canonicalize the resulting path. This maps directly to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires a local attack path. An attacker must either install a malicious app on the same device or convince the user to open a crafted deeplink URI. The malicious deeplink supplies a _display_name value containing traversal sequences. When the PDF Reader processes the intent, the crafted filename resolves outside the app's intended file scope.

The attack does not require elevated privileges beyond those held by the calling app. The scope is limited to files the PDF Reader itself can access on the Android file system.

For technical details, see the VulDB entry for CVE-2026-84852 and the supplementary Google Document.

Detection Methods for CVE-2026-84852

Indicators of Compromise

Deeplink intents containing ../ or URL-encoded traversal sequences (%2e%2e%2f) in the _display_name parameter
Unexpected file creation or modification outside the Reader Tools PDF Reader app's designated storage directory
Presence of Reader Tools PDF Reader version 98.8 on managed Android devices

Detection Strategies

Inspect Android intent logs and system telemetry for calls to ActSplashNew.handleDeeplink with suspicious _display_name values
Use mobile application security testing tools to identify path traversal payloads passed via deeplinks
Monitor sideloaded applications and deeplink registrations on enterprise-managed Android devices

Monitoring Recommendations

Enable Android application usage auditing on MDM-enrolled devices to track deeplink activity
Alert on file access events by the PDF Reader app that target directories outside its sandbox
Track the installation base of Reader Tools PDF Reader 98.8 across the fleet until a fix is published

How to Mitigate CVE-2026-84852

Immediate Actions Required

Uninstall Reader Tools PDF Reader App version 98.8 from managed Android devices until the vendor issues a patch
Restrict installation of the affected app through mobile device management (MDM) policies
Advise users to avoid opening deeplinks or shared PDF file references from untrusted sources

Patch Information

No vendor patch is currently available. According to the disclosure, the vendor was contacted early but did not respond. Monitor the VulDB vulnerability entry #398130 for updates on remediation.

Workarounds

Replace Reader Tools PDF Reader with an alternative PDF viewer that receives active security maintenance
Disable deeplink handling for the affected app where the Android version permits per-app intent restrictions
Enforce Google Play Protect and application allowlisting to prevent installation of unvetted companion apps that could deliver malicious deeplinks

bash

# Example: Remove the affected package from managed Android endpoints via ADB
adb shell pm uninstall --user 0 com.readertools.pdfreader

# Verify removal
adb shell pm list packages | grep -i readertools