Comment by bob1029

I thought I was in the clear, then I remembered we have a small java binary that handles conversion of PDF to images. Turns out, Apache PdfBox depends on Log4j and can be compromised by feeding any malicious PDF into it.

How many products use PdfBox right now? This github POC link is not even an hour old...

https://github.com/eelyvy/log4jshell-pdf