---
title: "A PDF That Starts a Program: How the Launch Action Works"
description: One instruction tells the reader to start a Windows program. In 2010, criminals used it within weeks to install the Zeus banking trojan.
image: https://explore.bowbridge.net/hubfs/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg
---
[customer login](https://www.bowbridge.net/customer-portal/) english deutsch
[](https://www.bowbridge.net/en/)
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Anti-Virus - Cloud](https://www.bowbridge.net/en/anti-virus-cloud-for-sap-solutions/)
- [Anti-Virus for SAP Solutions](https://www.bowbridge.net/en/anti-virus-for-sap-solutions/)
- [Application Security for SAP Solutions](https://www.bowbridge.net/en/application-security-for-sap-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [Blog](https://explore.bowbridge.net/blog)
- [Protecting SAP Applications from Content-Based Attacks](https://www.bowbridge.net/en/guide-to-content-based-attacks-sap-applications/)
- [Intro to FIORI Cybersecurity](https://www.bowbridge.net/en/guide-to-sap-fiori-cybersecurity/)
- [Case Studies](https://www.bowbridge.net/en/sap-cybersecurity-resources/#casestudies)
- [White Papers](https://www.bowbridge.net/en/sap-cybersecurity-resources/#wp)
- [Webinars](https://www.bowbridge.net/en/sap-cybersecurity-resources/#webinars)
- [Partner Resources](https://www.bowbridge.net/en/bowbridge-partner-resources/)
- [About](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Company Profile](https://www.bowbridge.net/en/company-profile/)
- [Customers](https://www.bowbridge.net/en/customers/)
- [News](https://explore.bowbridge.net/news)
- [Careers](https://www.bowbridge.net/en/careers/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Software Downloads](https://www.bowbridge.net/en/bowbridge-downloads/)
- [Documentation](https://www.bowbridge.net/en/bowbridge-documentation/)
- [Support Videos](https://www.bowbridge.net/en/bowbridge-support-videos/)
- [Contact Technical Support](https://www.bowbridge.net/en/sap-cybersecurity-support/#form)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
- [DE](https://www.bowbridge.net/de/)
- [EN](https://www.bowbridge.net/en/news.html)
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Anti-Virus - Cloud](https://www.bowbridge.net/en/anti-virus-cloud-for-sap-solutions/)
- [Anti-Virus for SAP Solutions](https://www.bowbridge.net/en/anti-virus-for-sap-solutions/)
- [Application Security for SAP Solutions](https://www.bowbridge.net/en/application-security-for-sap-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [Blog](https://explore.bowbridge.net/blog)
- [Protecting SAP Applications from Content-Based Attacks](https://www.bowbridge.net/en/guide-to-content-based-attacks-sap-applications/)
- [Intro to FIORI Cybersecurity](https://www.bowbridge.net/en/guide-to-sap-fiori-cybersecurity/)
- [Case Studies](https://www.bowbridge.net/en/sap-cybersecurity-resources/#casestudies)
- [White Papers](https://www.bowbridge.net/en/sap-cybersecurity-resources/#wp)
- [Webinars](https://www.bowbridge.net/en/sap-cybersecurity-resources/#webinars)
- [Partner Resources](https://www.bowbridge.net/en/bowbridge-partner-resources/)
- [About](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Company Profile](https://www.bowbridge.net/en/company-profile/)
- [Customers](https://www.bowbridge.net/en/customers/)
- [News](https://explore.bowbridge.net/news)
- [Careers](https://www.bowbridge.net/en/careers/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Software Downloads](https://www.bowbridge.net/en/bowbridge-downloads/)
- [Documentation](https://www.bowbridge.net/en/bowbridge-documentation/)
- [Support Videos](https://www.bowbridge.net/en/bowbridge-support-videos/)
- [Contact Technical Support](https://www.bowbridge.net/en/sap-cybersecurity-support/#form)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
# A PDF That Starts a Program: How the Launch Action Works
Nov 7, 2026, 10:15:43 AM by Joerg Schneider-Simon
A PDF can tell your computer to start a program, and the file does not need any malicious code or any software bug to do it. This is episode 1 of File Security 101, our series on file-based threats your anti-malware does not see.
The video explains it in about two minutes.
The article adds the details and the research behind it.
## A PDF is more than a page
Most people think of a PDF as paper on a screen: text and pictures, nothing that runs. Inside, a PDF is a list of numbered objects. One object holds the page tree, others hold the text, the fonts and the images. The document catalog, the object the reader reads first, can also hold an entry called `/OpenAction`. It tells the reader what to do the moment the file opens.
The PDF specification defines several types of action for this: go to a page, play a sound, open a link, run JavaScript, or start an application. That last type is called Launch.
## The attack: Launch
An attacker points the Launch action at a program that is already on every Windows computer, such as the command line `cmd.exe`, and passes it a command. The command can, for example, download a file from the attacker's server and start it, or extract an executable that is hidden inside the PDF itself.
Adobe Reader shows a warning before it launches anything. In 2010, researcher Didier Stevens showed that part of that warning text could be set by the PDF itself ([Help Net Security](https://www.helpnetsecurity.com/2010/03/31/researcher-exploits-pdf-file-without-using-a-vulnerability)). An attacker could add a line such as "To view the content of this document, click Open." To the reader, the result looks like a routine prompt. Other PDF readers of the time, such as Foxit Reader, showed no warning at all.
Stevens' proof of concept used no JavaScript, so turning off JavaScript did not help. In his words: "I'm not exploiting a vulnerability, just being creative with the PDF language specs."
## It happened
Criminals adopted the technique within weeks. In April 2010, the security firm Websense tracked several thousand attacks with PDFs that used the Launch action to install Zeus, a trojan best known for stealing online banking credentials. The mails posed as delivery notices, and the PDF asked the reader to save and open a file that was in fact a Windows program ([Computerworld](https://www.computerworld.com/article/2756874/zeus-botnet-exploits-unpatched-pdf-flaw.html)).
Adobe's first answer was a setting, not a patch, because the feature worked as designed: users were asked to turn off the option that lets PDFs open other applications. In June 2010, Reader 9.3.3 and 8.2.3 followed with an update. It removed the attacker's control over the warning text, tracked as [CVE-2010-1240](https://nvd.nist.gov/vuln/detail/CVE-2010-1240), and disabled the Launch action by default ([Didier Stevens](https://blog.didierstevens.com/2010/06/29/)). The Launch action is still part of the PDF format, so any reader that supports it, and any reader set up to allow it, can still be told to start a program.
## Why nobody notices
A malware scanner looks for malicious code. A PDF of this kind may hold none: just one instruction that points at a program Windows already trusts. When the actual malware is downloaded later from the attacker's server, it arrives after the PDF has passed every check. To a scanner, the PDF itself is a valid document that uses a documented feature.
## What to do
- Never confirm an unexpected prompt from a document that wants to start a program or open another file.
- Check your PDF reader's settings: documents should not be allowed to start other applications. In Adobe Acrobat and Reader, this is under Trust Manager, "Allow opening of non-PDF file attachments with external applications".
Settings protect one computer, as long as nobody changes them. bowbridge Content Disarm and Reconstruct takes a PDF apart and builds a new one from only its text, images and layout. Actions that start a program are not copied, so the instruction does not survive, whatever reader opens the file later.
## Sources
- [Researcher exploits PDF file without using a vulnerability](https://www.helpnetsecurity.com/2010/03/31/researcher-exploits-pdf-file-without-using-a-vulnerability), Help Net Security, March 31, 2010
- [Zeus botnet exploits unpatched PDF flaw](https://www.computerworld.com/article/2756874/zeus-botnet-exploits-unpatched-pdf-flaw.html), Computerworld, April 15, 2010
- [Adobe Reader 9.3.3 fixes the /Launch warning and disables /Launch by default](https://blog.didierstevens.com/2010/06/29/), Didier Stevens, June 29, 2010
- [CVE-2010-1240](https://nvd.nist.gov/vuln/detail/CVE-2010-1240), National Vulnerability Database (fixed in Adobe bulletin APSB10-15)
## Subscribe to upcoming episodes
#### Share this on social:
[Share via LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-1-a-pdf-that-starts-a-program&title=A+PDF+That+Starts+a+Program%3A+How+the+Launch+Action+Works&summary=One+instruction+tells+the+reader+to+start+a+Windows+program.+In+2010%2C+criminals+used+it+within+weeks+to+install+the+Zeus+banking+trojan.) [Share via Twitter](https://twitter.com/intent/tweet?url=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-1-a-pdf-that-starts-a-program&text=A+PDF+That+Starts+a+Program%3A+How+the+Launch+Action+Works) [Share via Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-1-a-pdf-that-starts-a-program) [Share via Email](mailto:?subject=A+PDF+That+Starts+a+Program%3A+How+the+Launch+Action+Works&body=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-1-a-pdf-that-starts-a-program)
### Don't miss the latest SAP security news
#### bowbridge
- [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/)
- [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/)
- [About bowbridge](https://www.bowbridge.net/en/about-bowbridge-software/)
- [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/)
- [Contact](https://www.bowbridge.net/en/contact-bowbridge/)
- [Customer Login](https://www.bowbridge.net/customer-portal/)
#### Contact
**GERMANY**
Tel: +49 (0) 6227 - 69899 - 50
Fax: +49 (0) 6227 - 69899-59
Email: [info@bowbridge.net](mailto:info@bowbridge.net)
**USA**
Tel: +1 650 - 617 - 3408
Fax: +1 650 - 617 - 3201
Email: [us-sales@bowbridge.net](mailto:us-sales@bowbridge.net)
#### Connect With Us
- [English](https://www.bowbridge.net/en/)
- [Deutsch](https://www.bowbridge.net/)
Copyright © 2023 bowbridge Software GmbH. All rights reserved. [Privacy Policy](https://www.bowbridge.net/en/privacy-policy)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Joerg Schneider-Simon",
"url" : "https://explore.bowbridge.net/file-security-101/author/joerg-schneider-simon"
},
"dateModified" : "2026-11-07T09:15:14.072Z",
"datePublished" : "2026-11-07T09:15:43.000Z",
"headline" : "A PDF That Starts a Program: How the Launch Action Works",
"image" : [ "https://explore.bowbridge.net/hubfs/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg" ],
"mainEntityOfPage" : {
"@id" : "https://explore.bowbridge.net/file-security-101/episode-1-a-pdf-that-starts-a-program",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://explore.bowbridge.net/hubfs/bowbridge_logo_2-1.png"
},
"name" : "bowbridge Software GmbH"
}
}
```