Zero-Day & Known Exploit Signature • QuickSand v2.3.0

Detecting CVE-2025-66516 in Malicious Documents & Streams

Summary: pdf.exploit Apache Tika/PDFBox XFA XML External Entity (XXE) injection (CVE-2025-66516). QuickSand unpacks nested container streams (OLE2, OOXML, RTF, PDF filter chains, and archives) in memory to detect CVE-2025-66516 payloads in <50ms.

CVE-2025-66516 Vulnerability Identifier
T1190, T1203 MITRE ATT&CK Technique
PDF Target Stream Vector

QuickSand YARA Signatures for CVE-2025-66516

YARA Rule Identifier Stream Detection Description MITRE ATT&CK Engine Module Severity
pdf_exploit_xfa_xxe_CVE_2025_66516 pdf.exploit Apache Tika/PDFBox XFA XML External Entity (XXE) injection (CVE-2025-66516) T1190, T1203 PDF 10/10

Scan Files for CVE-2025-66516 via REST API (<100ms)

Block weaponized uploads exploiting CVE-2025-66516 in your web app, S3/GCS bucket, or SOAR phishing workflow:

curl -X POST "https://malwaretracker-912661936520.europe-west1.run.app/v1/scan?store=false" \
  -H "X-API-Key: mt_live_YOUR_API_KEY" \
  -F "file=@untrusted_document.doc"
Get Free API Key (1,000 Scans/Mo) → Scan a File Online Now

Related Document Exploit CVEs Detected by QuickSand

CVE-2026-34621 CVE-2026-21514 CVE-2026-21509 CVE-2025-8088 CVE-2025-59689 CVE-2025-24071 CVE-2025-24054 CVE-2025-21298 CVE-2024-4367 CVE-2024-43451 CVE-2024-21413 CVE-2023-38831 CVE-2023-36884 CVE-2023-36025 CVE-2023-23397 CVE-2023-21716 CVE-2023-21608