The case of the 9 bit AES key

Researchers discovered that several PDF implementations, including MuPDF, generate AES-256 encryption keys from severely limited random state spaces—in MuPDF's case, only 9 bits of randomness actually affect the final key. This vulnerability allows attackers to decrypt password-protected PDFs without knowing the password by simply enumerating the small keyspace, and similar weaknesses exist in other PDF editors like Foxit that rely on time-based randomness for key generation.