CVE-2015-9252

What it actually does

Endless recursion in QPDFTokenizer::resolveLiteral causes stack exhaustion and process termination when parsing specially crafted input.

Why it matters to the business

Applications using the affected library become unresponsive or crash when processing certain files, leading to workflow interruptions and potential data-processing failures.

How an attack unfolds

An attacker supplies a malformed input file that triggers repeated calls to resolveLiteral during tokenization; when the library processes the file the recursion exhausts available stack space and the process terminates.

How to fix it

Upgrade QPDF to version 7.0.0 or later; rebuild and redeploy any dependent applications against the fixed library.

How to confirm the fix worked

Confirm the installed QPDF version is 7.0.0 or newer; attempt parsing of known recursion-triggering test files and verify the process no longer crashes.

Typical attack path

1. Attacker crafts a file that induces infinite recursion in the tokenizer
2. Victim or automated process opens the file with an affected QPDF version
3. Library enters endless recursion and exhausts stack memory
4. Process crashes or hangs, resulting in denial of service

How to detect it

Review application and system logs for abrupt terminations or stack-overflow errors occurring during PDF parsing with QPDF; correlate crashes with file-processing timestamps.

What your security team should do

• Immediately upgrade all instances of QPDF to 7.0.0 or newer
• Scan build pipelines and containers for older QPDF versions
• Add automated version checks to CI/CD pipelines
• Monitor crash logs for stack-overflow signatures related to QPDFTokenizer