CVE-2024-7868 Uninitialized variable in Xpdf 4.05 due to invalid JPEG header
An attacker can cause a denial of service via a crafted PDF file exploiting an uninitialized variable in the JPEG decoder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-7868?
CVE-2024-7868 is a low-severity memory corruption vulnerability in Xpdfreader Xpdf, published on 15 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. The proof-of-concept PDF file causes a segfault attempting to read from an invalid address.
Which versions are affected by CVE-2024-7868?
It affects 1 product.
Products include Xpdfreader Xpdf.
How do I fix CVE-2024-7868?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-7868 being exploited?
There is no known exploitation of CVE-2024-7868 in the wild and no public exploit code.
Other vulnerabilities in Xpdfreader Xpdf
Sources
Also known as AZL-47857, AZL-47871, GHSA-x6qm-4c7w-8wm7, UBUNTU-CVE-2024-7868.