CVE-2024-4976 Out-of-bounds array write in Xpdf 4.05 due to missing object type check
An out-of-bounds array write in Xpdf allows attackers to execute arbitrary code or cause denial of service via malicious PDFs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-4976?
CVE-2024-4976 is a low-severity memory corruption vulnerability in Xpdfreader Xpdf, published on 15 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference.
Weakness: CWE-787
Which versions are affected by CVE-2024-4976?
It affects 1 product.
Products include Xpdfreader Xpdf.
How do I fix CVE-2024-4976?
No fix has been published for CVE-2024-4976 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-4976 being exploited?
There is no known exploitation of CVE-2024-4976 in the wild and no public exploit code.
Other vulnerabilities in Xpdfreader Xpdf
Sources
Also known as GHSA-qvmh-c8p3-rp3h, UBUNTU-CVE-2024-4976.