[Bug]: PDF.js wrongly prompts for a password on attachment-only encrypted PDFs. #20049
Description
Attach (recommended) or Link to PDF file
Web browser and its version
140.0.2 (aarch64) (also tested in Chrome 137.0.7151.120)
Operating system and its version
MacOS 15.5
PDF.js version
v5.3.31
Is the bug present in the latest PDF.js version?
Yes
Is a browser extension
No
Steps to reproduce the problem
Open a PDF file with encrypted attachments
What is the expected behavior?
It should only ask for password when the attachments are accessed.
What went wrong?
When a PDF is secured using AES-256 but restricts encryption to only the attachments while leaving all page, image, and metadata streams in clear text, Adobe Acrobat and Chrome viewer open the file normally and only demand a password if an attachment is accessed.
PDF.js, however, treats the entire document as protected, so it displays the “This document is password-protected” dialog before rendering any pages. This results in it asking for passwords for documents that contain no attachments at all or whose attachments were removed, blocking users from viewing otherwise unencrypted content.
Link to a viewer
No response
Additional context
No response