Out-of-Bounds Array Write Vulnerability in Xpdf by Foomatic
CVE-2025-3154

2.1LOW

Key Information:

Vendor

XPDF

Status
XPDF
Vendor
CVE Published:
2 April 2025

What is CVE-2025-3154?

An out-of-bounds array write vulnerability exists in Xpdf versions 4.05 and earlier, which can be triggered by an incorrect VerticesPerRow value in a PDF shading dictionary. This flaw may allow attackers to manipulate the application's memory, potentially leading to application crashes or arbitrary code execution, thereby compromising the security and integrity of the system.

Affected Version(s)

Xpdf all 0 <= 4.05

References

https://www.xpdfreader.com/security-bug/CVE-2025-3154.html

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erik Viken
.