Global Buffer Overflow in XPDF Software by JH Cloos
CVE-2022-38236

7.8HIGH

Key Information:

Vendor

XPDF Project

Status
XPDF
Vendor
CVE Published:
16 August 2022

What is CVE-2022-38236?

A global buffer overflow vulnerability was identified in the XPDF product due to an improper handling of input within the Lexer::getObj(Object*) function at /xpdf/Lexer.cc. This flaw allows for potential unauthorized access and could lead to exploitation if an attacker crafts a specific input that exceeds the allocated memory limit.

References

https://github.com/jhcloos/xpdf/issues/8
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.