Short answer: yes, a PDF can have a virus. Not in the sense that the file itself is a program you run, but in the sense that a PDF can contain instructions that make your PDF reader do things you never asked for: run scripts, open other programs, drop attachments on your disk, or exploit a bug in the reader to take over your machine.
This surprises people because we think of PDFs as "printed paper on a screen." In reality the PDF specification is a container format with room for interactive forms, multimedia, JavaScript and file attachments. Attackers use exactly those features.
The four ways a malicious PDF attacks you
1. Embedded JavaScript
PDF readers such as Adobe Acrobat support JavaScript so forms can validate input or calculate totals. A malicious PDF stores its script in a `/JavaScript` or `/JS` object and wires it to an `/OpenAction`, which fires the moment the file opens. The script can then probe the reader for known bugs, download a second-stage payload, or trick you with fake dialogs.
2. Launch actions
A `/Launch` action tells the reader to start an external program. Older readers would happily run `cmd.exe` or a dropped executable when the page loaded. Modern readers show a warning, but many people click through warnings, and the attacker only needs one click.
3. Embedded files
PDFs can carry attachments via `/EmbeddedFiles`. The visible page might read "Double-click the paperclip to view your invoice," and the paperclip is an `.exe`, a macro-laden Word document, or another PDF that carries the real exploit. The outer PDF is clean; the inner file is the weapon.
4. Reader exploits
The most dangerous class needs no scripts at all. A malformed font, image stream or annotation triggers a memory-corruption bug in the reader itself. This is how the well-known Acrobat zero-days worked. The only defense is a patched reader, which is why "keep your software updated" is not just boilerplate advice.
Why email is the usual delivery route
Almost every real-world PDF attack arrives as an attachment: a fake invoice, a shipping notice, a résumé, a "signed contract." The PDF icon is trusted, spam filters allow the format, and the file opens with one click. If a PDF arrives unexpectedly, that is already a warning sign.
What a PDF cannot do
It helps to know the limits too. A PDF cannot infect you just by sitting in your Downloads folder. It has to be opened by a reader that honors its instructions or has a bug the file exploits. Viewing a PDF in a heavily sandboxed viewer like Chrome's built-in reader, with JavaScript disabled, blocks most of the attacks above. See how to open a suspicious PDF safely for the exact steps.
How to check a PDF before you open it
- Check the sender and context. Were you expecting this file? Does the email address match the company it claims to be from?
- Look at the real filename. `Invoice.pdf.exe` is not a PDF. Turn on file extensions in your OS so double extensions are visible.
- Scan it for risky structures. Our free PDF Virus Scanner reads the file in your browser and flags JavaScript, OpenAction triggers, Launch commands and embedded files. Nothing is uploaded, so you can scan confidential documents too.
- Run a real antivirus check if the scanner flags anything, or upload non-sensitive files to a multi-engine service.
- Open it in a sandboxed viewer rather than a full desktop reader if you still need to read it.
For a deeper checklist, read how to check if a PDF is safe. For the technical background on the markers scanners look for, see what PDF vulnerabilities are.
Bottom line
A PDF is a document format, but it is also a small programmable container. Treat unexpected PDFs the way you would treat an unexpected `.exe`: verify the source, scan the structure, and open it in the most restricted viewer that does the job.