CVE-2022-34503 Memory corruption in n/a

Medium 6.5 Published 22 Jul 2022 Updated 3 Aug 2024

Attackers can cause a Denial of Service in QPDF by providing a crafted PDF file that triggers a heap buffer overflow.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-34503?

CVE-2022-34503 is a medium-severity memory corruption vulnerability in n/a, published on 22 Jul 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

Weakness: CWE-787

Which versions are affected by CVE-2022-34503?

It affects 1 product.

Products include Qpdf Project Qpdf.

How do I fix CVE-2022-34503?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-34503 being exploited?

There is no known exploitation of CVE-2022-34503 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2022-34503, GHSA-w55w-49h8-p8xc, OESA-2024-1965, OESA-2024-1966, OESA-2024-1967, OESA-2024-1968 and 1 more.