CVE-2022-24107

What it actually does

Missing integer overflow check in JPXStream.cc allows crafted JPEG2000 data inside a PDF to trigger a buffer overflow, enabling arbitrary code execution with the privileges of the Xpdf process.

Why it matters to the business

Successful local exploitation can lead to full compromise of a workstation when a user opens a malicious PDF, potentially resulting in data theft, ransomware deployment, or persistence; however, the issue is more than four years old with negligible exploit activity, so immediate operational disruption risk remains low for most environments.

How an attack unfolds

An attacker creates a PDF containing a malformed JPEG2000 stream that triggers the unchecked integer calculation in JPXStream.cc. When the victim opens the file with an affected Xpdf binary, the overflow corrupts memory structures and allows the attacker to redirect execution to attacker-controlled code.

How to fix it

Upgrade glyphandcog xpdfreader to version 4.04 or later; if an upgrade is not immediately feasible, replace Xpdf with a maintained PDF viewer such as poppler-utils, evince, or qpdf and restrict execution of the older binary via application allow-listing.

How to confirm the fix worked

Run 'xpdf -v' or inspect the binary version string to confirm 4.04 or newer is installed; for source builds, verify that JPXStream.cc contains the added overflow checks present in the 4.04 release.

Typical attack path

1. Craft a PDF embedding a JPEG2000 image with integer values chosen to overflow JPXStream allocation calculations
2. Deliver the PDF via email, web download, or removable media
3. Victim opens the file using Xpdf on a local workstation
4. Integer overflow occurs during stream parsing, leading to heap or stack corruption and code execution

How to detect it

Search endpoint logs and file-share histories for PDF files opened with Xpdf that match known malicious JPEG2000 stream patterns; monitor for unexpected Xpdf process crashes or child-process creation after PDF handling.

What your security team should do

• Inventory all systems running Xpdf and schedule upgrades to 4.04+ within standard patch windows
• Block or monitor execution of xpdf binaries older than 4.04 via endpoint policy
• Educate users to avoid opening untrusted PDFs with legacy viewers