Heap-Based Buffer Over-Read in Poppler JPEG2000 Processing

CVE-2019-12293

What is CVE-2019-12293?

Poppler, a widely used PDF rendering library, is susceptible to a heap-based buffer over-read vulnerability in its JPEG2000 stream processing. This issue arises when JPXStream::init processes data with inconsistent height or width parameters. Exploiting this vulnerability could potentially lead to information disclosure or unexpected behavior, impacting the integrity of the software and its capability to handle JPEG2000 formatted content properly. Users of Poppler versions up to and including 0.76.1 are advised to apply the necessary security updates to mitigate the risk associated with this vulnerability.

References