Invalid Header Info in DCT (JPEG) Stream Can Lead to Segfault
CVE-2024-7868

2.1LOW

Key Information:

Vendor

XPDF

Status
XPDF
Vendor
CVE Published:
15 August 2024

What is CVE-2024-7868?

A vulnerability exists in Xpdf Reader, affecting version 4.05 and earlier, where improper handling of invalid header information within DCT (JPEG) streams can result in an uninitialized variable scenario in the DCT decoder. This flaw can lead to application crashes, specifically a segmentation fault which occurs when attempting to read from an invalid memory address. Security measures should be taken to ensure that users are protected from potential exploits utilizing crafted PDF files.

Affected Version(s)

Xpdf all 0 <= 4.05

References

https://www.xpdfreader.com/security-bug/CVE-2024-7868.html

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

.