← All detection heuristics · Suspicious
critical
PDF_JS_TOOLBUTTON_UAF_EXPLOIT
What it means
PDF JavaScript combines app.addToolButton(), app.removeToolButton(), heap-spray arrays, and unescape('%u...') shellcode markers.
Why it fires
The ToolButton lifecycle calls, heap-spray arrays, and encoded shellcode form an Adobe Reader use-after-free exploitation pattern. The broad API and heap-spray conjunction is intentionally not assigned to one CVE because it does not distinguish CVE-2013-3346 from later Reader object-lifetime bugs.