← Vulnerability feed

Vulnerability record · CVE-2009-3604 · published 21 October 2009

CVE-2009-3604: Foolabs xpdf vulnerability

FFoolabs · Xpdf

The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.

9.3 CVSS 2.0 High EPSS 8.7% · top 5.0% CWE-399 · CWE-399
9.3CVSS 2.0 base score
8.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
92References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl4.patch Patch
http://cgit.freedesktop.org/poppler/poppler/commit/?id=9cf2325fb2
http://cgit.freedesktop.org/poppler/poppler/diff/?id=284a928996&id2=75c3466ba2
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035340.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035399.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035408.html
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
http://secunia.com/advisories/37023 Vendor Advisory
http://secunia.com/advisories/37028 Vendor Advisory
http://secunia.com/advisories/37037 Vendor Advisory
http://secunia.com/advisories/37042 Vendor Advisory
http://secunia.com/advisories/37043 Vendor Advisory
http://secunia.com/advisories/37053 Vendor Advisory
http://secunia.com/advisories/37077 Vendor Advisory
http://secunia.com/advisories/37079 Vendor Advisory
http://secunia.com/advisories/37114
http://secunia.com/advisories/37159
http://secunia.com/advisories/39327
http://secunia.com/advisories/39938
http://securitytracker.com/id?1023029
http://site.pi3.com.pl/adv/xpdf.txt Exploit
http://sunsolve.sun.com/search/document.do?assetkey=1-66-274030-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021706.1-1
http://www.debian.org/security/2010/dsa-2028
http://www.debian.org/security/2010/dsa-2050
http://www.mandriva.com/security/advisories?name=MDVSA-2009:287
http://www.mandriva.com/security/advisories?name=MDVSA-2010:087
http://www.mandriva.com/security/advisories?name=MDVSA-2011:175
http://www.securityfocus.com/bid/36703 ExploitPatch
http://www.ubuntu.com/usn/USN-850-1
http://www.ubuntu.com/usn/USN-850-3
http://www.vupen.com/english/advisories/2009/2924 PatchVendor Advisory
http://www.vupen.com/english/advisories/2009/2928 PatchVendor Advisory
http://www.vupen.com/english/advisories/2010/0802
http://www.vupen.com/english/advisories/2010/1040
http://www.vupen.com/english/advisories/2010/1220
https://bugzilla.redhat.com/show_bug.cgi?id=526911 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/53795
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10969
https://rhn.redhat.com/errata/RHSA-2009-1500.html

Track CVE-2009-3604 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2009-0165Foolabs xpdf vulnerabilityInteger overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified i…EPSS 3.6%10.0CVE-2005-3625Easy software products cups vulnerabilityXpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of servic…EPSS 3.8%9.3CVE-2009-3603Foolabs xpdf vulnerabilityInteger overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to exec…EPSS 8.6%9.3CVE-2009-3606Foolabs xpdf vulnerabilityInteger overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote a…EPSS 8.6%9.3CVE-2009-3608Foolabs xpdf vulnerabilityInteger overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegrap…EPSS 10%9.3CVE-2009-3607Poppler vulnerabilityInteger overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial …EPSS 5.9%7.8CVE-2022-24106Glyphandcog xpdfreader integer overflow vulnerabilityIn Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leadin…EPSS 0.31%7.8CVE-2022-24107Glyphandcog xpdfreader integer overflow vulnerabilityXpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2009-3604), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.