> I'd just disable script evaluation if you don't specifically need that.

This vuln works even with scripting in PDF.js disabled.