CVE-2024-4141 Out-of-bounds array write in Xpdf 4.05 due to incorrect bounds check

2024-04-2418:36:49

CWE-787

GandC

www.cve.org

cve-2024-4141

xpdf

out-of-bounds array

type 1 font

bounds check

invalid character code

modern compilers

CVSS3

2.9

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

4.4

Confidence

High

EPSS

Percentile

9.0%

JSON

Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font. The root problem was a bounds check that was being optimized away by modern compilers.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "all"
    ],
    "product": "Xpdf",
    "vendor": "Xpdf",
    "versions": [
      {
        "lessThan": "4.05",
        "status": "affected",
        "version": "0",
        "versionType": "version"
      }
    ]
  }
]