PDF produced by outdated engine with known CVEs

The FFmpeg multimedia framework patched PixelSmash, a critical remote code execution flaw triggered by processing a crafted media file; because FFmpeg is embedded in countless media and content pipelines, the vulnerable component becomes a backdoor into every product that ships it. The same logic applies to document generation: a PDF rendered by an outdated library inherits every vulnerability of that engine (MITRE T1195.001), and the file looks perfectly normal to users and scanners alike. SBOM analysis closes this gap by inventorying the components embedded in a file, resolving their versions, and matching them against vulnerability databases to surface known CVEs. The demo uses a benign PDF generated with an outdated engine, so it is safe to open while demonstrating the risk clearly.