You will never find a file on your hard drive named cidfontf1.ttf or cidfontf1.otf. Instead, you will see this name inside:
Run the following command to reinterpret and re-embed the missing CIDFont:
gs -dSAFER -dBATCH -dNOPAUSE -sDEVICE=pdfwrite \
-sOutputFile=output.pdf \
-sSubstFont=CIDFont.cidfontf1+ \
input.pdf
Or substitute with a standard base font:
gs -dSAFER -dBATCH -dNOPAUSE -sDEVICE=pdfwrite \
-sOutputFile=fixed.pdf \
-c "/cidfontf1 font new /HeiseiMin-W3 findfont install" \
-f broken.pdf
If you have a PDF that references cidfontf1 font new and it fails to render or extract text, follow these solutions: cidfontf1 font new
The keyword cidfontf1 font new is a relic and a reality of working with multilingual PDFs. It is neither a virus nor a corruption—it is simply a generic name assigned by a font subsetter or PDF generator that lacked a proper naming convention.
Understanding this identifier allows you to:
Next time you encounter cidfontf1 font new, treat it as a signal: your PDF is using a subsetted CID-keyed Asian font with a synthetic name. With the tools and techniques above, you can decode, replace, or eliminate it. You will never find a file on your
If you’re seeing /CIDFont/F1 in a PDF or PostScript file, it refers to a CID-keyed font (commonly used for CJK fonts – Chinese, Japanese, Korean). F1 is just a local name for the font resource.
CIDFontF1 is not a font family you can download or purchase. It is a specific internal identifier often used by Adobe Acrobat and other PDF engines as a fallback or substitute name.
Historically, this identifier is associated with Adobe Type 1 fonts that were CID-keyed. Specifically, it often relates to the "Adobe Sans" or generic serif/sans-serif substitutions used when the original font intended for the document is missing or cannot be embedded. Or substitute with a standard base font: gs
When you see "CIDFontF1" in a PDF file, it usually means one of two things:
Short answer: No. It is not malware.
Long answer: While not a virus, a sudden appearance of cidfontf1 in your font manager could indicate:
However, legitimate malware sometimes hides under generic system names. If you see cidfontf1 in your Startup folder or running as a .exe process, run a virus scan immediately. The real cidfontf1 should never be an executable file.
