The fix, in one snippet
strings file.pdf | grep -i '/Launch\|/OpenAction'Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scanner looks for /OpenAction and additional-action (/AA) dictionaries at document, page and annotation level, then reads the action type in /S: /Launch (run a program or file, with its /F and Windows /P parameters), /URI, /SubmitForm, /GoToR (open a remote file), /ImportData, /JavaScript, /Rendition and /Movie. It reports the type and, where readable, the target, for example /Launch /F (cmd.exe) /P (/c start …). Page-open (/O) and page-close (/C) triggers are noted separately. Limits are as for the JavaScript check; a /URI on a button is common in legitimate documents, so severity depends on the trigger and the target.
Why it matters
A /Launch action tells the reader to run something. Didier Stevens showed in 2010 that a PDF could start an embedded executable with no vulnerability at all, only a warning dialog whose text the attacker partly controls. Adobe hardened the dialog, but the action still exists and readers differ in how they handle it; Check Point documented in 2024 how Foxit Reader's dialog defaults led users to approve such actions. /URI on open is a phishing redirect, /SubmitForm posts whatever you typed into the form to the attacker's server, and /GoToR opens a second, remote document. Acrobat and Foxit users are the main audience; browser viewers ignore /Launch.
How to fix it
Do not click through reader dialogs you did not expect. In Acrobat: Preferences > Trust Manager > untick "Allow opening of non-PDF file attachments with external applications", and enable Protected View. Keep the reader current. To neutralise a document whose text you need, print it to a new PDF or export it as images; the actions do not survive. Confirm the finding with pdfid.py (it counts /OpenAction, /AA and /Launch) before deciding. Related: PDF JavaScript. Guide: malicious PDF files.
Where this fits
PDF contains launch or open actions is check 13 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits PDF contains JavaScript (high), where the PDF contains JavaScript, which Adobe Acrobat and some other readers execute when the document opens or when an action fires. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
PDF contains launch or open actions closes one route in. Immediately below it: Windows shortcut (.lnk) file, where the file is a Windows shortcut (.lnk), which can run any command line under any icon and any name, and is a favourite disguise for malware droppers; Deeply nested archive, where the archive contains further archives several levels deep, a structure used to exhaust scanners and to strip the Mark of the Web before the payload arrives; Executable program file, where the file is an executable program (Windows PE, macOS Mach-O, Linux ELF, an installer or a script) that will run with your privileges if opened.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: PDF contains launch or open actions (high severity)
Scanner check id: pdf-launch-actionThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
