Out-of-Bounds Array Write Vulnerability in Xpdf 4.05 and Earlier
CVE-2025-2574

2.1LOW

Key Information:

Vendor

XPDF

Status
XPDF
Vendor
CVE Published:
20 March 2025

What is CVE-2025-2574?

An out-of-bounds array write vulnerability exists in Xpdf versions 4.05 and earlier, caused by improper handling of integer overflow within the PostScript function interpreter. This flaw can potentially allow attackers to execute arbitrary code or cause a denial of service, making it a significant concern for users of the affected versions. Users are advised to update to the latest version to mitigate potential risks associated with this vulnerability.

Affected Version(s)

Xpdf all Version <= 4.05

References

https://www.xpdfreader.com/security-bug/CVE-2025-2574.html

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erik Viken
.