CVE-2024-4141 Out-of-bounds array write in Xpdf 4.05 due to incorrect bounds check

2024-04-2418:36:49

CWE-787

GandC

github.com

xpdf 4.05

out-of-bounds

array write

bounds check

CVSS3

2.9

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

6.9

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font. The root problem was a bounds check that was being optimized away by modern compilers.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:xpdf:xpdf:*:*:*:*:*:*:*:*"
    ],
    "vendor": "xpdf",
    "product": "xpdf",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.05",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]