← Vulnerability feed

Vulnerability record · CVE-2007-5393 · published 8 November 2007

CVE-2007-5393: Xpdf memory buffer overflow vulnerability

Xpdf · Xpdf

Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.

9.3 CVSS 2.0 High EPSS 6.4% · top 6.6% CWE-119 · Memory buffer overflow
9.3CVSS 2.0 base score
6.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
182References
16 Jun 2026Last modified by NVD

Description

Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/26503
http://secunia.com/advisories/27260 PatchVendor Advisory
http://secunia.com/advisories/27553 Vendor Advisory
http://secunia.com/advisories/27573 Vendor Advisory
http://secunia.com/advisories/27574
http://secunia.com/advisories/27575 Vendor Advisory
http://secunia.com/advisories/27577 Vendor Advisory
http://secunia.com/advisories/27578 Vendor Advisory
http://secunia.com/advisories/27579 Vendor Advisory
http://secunia.com/advisories/27599
http://secunia.com/advisories/27615
http://secunia.com/advisories/27618
http://secunia.com/advisories/27619
http://secunia.com/advisories/27632
http://secunia.com/advisories/27634
http://secunia.com/advisories/27636
http://secunia.com/advisories/27637
http://secunia.com/advisories/27640
http://secunia.com/advisories/27641
http://secunia.com/advisories/27642
http://secunia.com/advisories/27645
http://secunia.com/advisories/27656
http://secunia.com/advisories/27658
http://secunia.com/advisories/27705
http://secunia.com/advisories/27718
http://secunia.com/advisories/27721
http://secunia.com/advisories/27724
http://secunia.com/advisories/27743
http://secunia.com/advisories/27772
http://secunia.com/advisories/27856
http://secunia.com/advisories/28043
http://secunia.com/advisories/28812
http://secunia.com/advisories/29104
http://secunia.com/advisories/29604
http://secunia.com/advisories/30168
http://secunia.com/secunia_research/2007-88/advisory/ Vendor Advisory
http://security.gentoo.org/glsa/glsa-200711-22.xml
http://security.gentoo.org/glsa/glsa-200711-34.xml
http://security.gentoo.org/glsa/glsa-200805-13.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.761882

Track CVE-2007-5393 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2005-3625Easy software products cups vulnerabilityXpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of servic…EPSS 3.8%10.0CVE-2004-0888Easy software products cups vulnerabilityMultiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to …EPSS 9.5%10.0CVE-2004-0889Easy software products cups vulnerabilityMultiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attackers to cause a denial of service (cras…EPSS 6.2%9.3CVE-2009-4035Gnome gpdf code injection vulnerabilityThe FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, d…EPSS 3.8%9.3CVE-2007-5392Xpdf memory buffer overflow vulnerabilityInteger overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF…EPSS 6.4%9.3CVE-2004-1125Easy software products cups improper input validation vulnerabilityBuffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3…EPSS 6.6%7.6CVE-2007-4352Xpdf vulnerabilityArray index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, …EPSS 7.0%7.6CVE-2006-1244Gnome gpdf vulnerabilityUnspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdfkit.framework, (b) gpdf, (c) pdftohtml…EPSS 2.2%

Source: NIST National Vulnerability Database (record CVE-2007-5393), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.