Vulnerability record · CVE-2024-7868 · published 15 August 2024

CVE-2024-7868: Xpdfreader xpdf use of uninitialized resource vulnerability

Xpdfreader · Xpdf

In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. The proof-of-concept PDF file causes a segfault attempting to read from an invalid address.

2.1 CVSS 4.0 Low EPSS 0.40% · top 65.8% CWE-457 · CWE-457CWE-908 · Use of uninitialized resource

2.1CVSS 4.0 base score

0.40%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

1References

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Xpdf Xpdfreader

References

Link	Tags
https://www.xpdfreader.com/security-bug/CVE-2024-7868.html	Vendor Advisory

Track CVE-2024-7868 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2021-30860Apple PDF integer overflow allows arbitrary code executionAn integer overflow in PDF processing was fixed by improved input validation in Apple iOS, iPadOS, macOS, watchOS and related PDF libraries (xpdf, po…KEVEPSS 76%analysed24 Aug 2021 7.8CVE-2022-38222Xpdfreader xpdf use after free vulnerabilityThere is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to …EPSS 0.47%29 Sep 2022 7.8CVE-2022-38928Xpdfreader xpdf null pointer dereference vulnerabilityXPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393.EPSS 0.43%21 Sep 2022 7.8CVE-2022-38171Xpdfreader xpdf integer overflow vulnerabilityXpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a speci…EPSS 0.34%22 Aug 2022 7.8CVE-2022-33108Xpdfreader xpdf out-of-bounds write vulnerabilityXPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files.EPSS 1.1%28 Jun 2022 7.8CVE-2022-30524Xpdfreader xpdf out-of-bounds write vulnerabilityThere is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y…EPSS 1.6%9 May 2022 7.8CVE-2020-24996Xpdfreader xpdf vulnerabilityThere is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2. It can be triggered by (for example)…EPSS 1.1%3 Sep 2020 7.8CVE-2020-24999Xpdfreader xpdf out-of-bounds write vulnerabilityThere is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. It can be triggered by sending a crafted PDF file to the…EPSS 1.1%3 Sep 2020

Source: NIST National Vulnerability Database (record CVE-2024-7868), CISA KEV, FIRST EPSS (scores of 2026-11-14). This page is refreshed as NVD updates the record.