Out-of-bounds array write vulnerability in Xpdf 4.05 and earlier
CVE-2024-4141

5.5MEDIUM

Key Information:

Vendor

Xpdf

Status
XPDF
Vendor
CVE Published:
24 April 2024

What is CVE-2024-4141?

A vulnerability exists in Xpdf that allows an out-of-bounds array write due to improper handling of invalid character codes in Type 1 fonts. The issue arises from a bounds check that is eliminated by advanced compiler optimizations, leading to potential exploitation by attackers. Successful exploitation can result in unpredictable behavior or crash of the application, thereby compromising the integrity and availability of the PDF processing functionalities.

References

https://www.xpdfreader.com/security-bug/CVE-2024-4141.html

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.