CVE-2026-84852: Path Traversal in Reader Tools PDF Reader App

This vulnerability involves a path traversal issue in the Reader Tools PDF Reader App 98.8 on Android, specifically in the ActSplashNew.handleDeeplink function within the File Handler component. By manipulating the _display_name argument, an attacker with local access can traverse file paths beyond intended directories. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available. The CVSS 4.0 score is 4.8, indicating medium severity, with attack vector local and low privileges required.

An attacker with local access to the affected device can exploit this vulnerability to perform path traversal, potentially accessing or manipulating files outside the intended scope of the application. This could lead to unauthorized file access or modification. However, the attack requires local access and low privileges, limiting the scope of impact. There is no evidence of active exploitation in the wild.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fix is provided, users should limit local access to the device and avoid untrusted inputs to the application. Monitor vendor channels for any future updates or patches addressing this issue.