CVE-2024-4141

2024-04-2419:15:47

CWE-787

GandC

web.nvd.nist.gov

out-of-bounds

xpdf 4.05

type 1 font

bounds check

optimization

invalid character code

CVSS3

2.9

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

4.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font. The root problem was a bounds check that was being optimized away by modern compilers.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "all"
    ],
    "product": "Xpdf",
    "vendor": "Xpdf",
    "versions": [
      {
        "lessThan": "4.05",
        "status": "affected",
        "version": "0",
        "versionType": "version"
      }
    ]
  }
]