CVE-2022-27135

What it actually does

Heap buffer overflow in readXRefTable within XRef.cc triggered by malformed cross-reference tables in PDF files, resulting in memory corruption that can lead to segmentation faults or undefined behavior during parsing.

Why it matters to the business

Disrupts PDF processing workflows in document viewers and converters, potentially halting automated pipelines or user productivity when handling untrusted files; low prevalence reduces widespread operational risk but still requires attention in environments using legacy PDF tools.

How an attack unfolds

An attacker crafts a PDF containing a specially malformed XRef table, delivers the file to a victim system, and triggers processing via the pdftoppm utility or similar xpdf components, causing the overflow during table parsing.

How to fix it

Upgrade xpdf to a version newer than 4.03 that resolves the XRef.cc parsing issue; if no official fixed release is available, replace with an alternative PDF processing library or restrict processing of untrusted PDFs.

How to confirm the fix worked

Confirm installed xpdf version exceeds 4.03, attempt parsing of known trigger PDFs in a controlled environment, and monitor for absence of segmentation faults or crashes during XRef table handling.

Typical attack path

1. Create malicious PDF with crafted XRef table
2. Deliver file to target via email, web download, or shared storage
3. Victim or automated process opens file with vulnerable xpdf binary
4. readXRefTable function overflows heap buffer during parsing
5. Application crashes or exhibits unspecified memory corruption effects

How to detect it

Review system and application logs for repeated crashes of pdftoppm or xpdf processes when handling PDF files; inspect file provenance of recently processed PDFs and correlate with segmentation fault entries in system logs.

What your security team should do

• Immediately restrict xpdf/pdftoppm usage on untrusted PDFs and prefer updated or alternative tools
• Scan environments for xpdf 4.03 deployments and prioritize removal or isolation
• Implement file-type validation and sandboxing for any remaining PDF processing
• Monitor EPSS trend and exploit availability for changes in risk posture