Cloudanix VulnDB

CVE-2022-30524

High · 7.8

CVSS

7.8

EPSS

1.6%

Published

May 9, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a common PDF tool can make it crash or behave unexpectedly when someone opens a specially made document, which might interrupt work or create security problems.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Invalid memory access in the TextLine class within TextOutputDev.cc during text extraction from PDF content containing characters positioned at large y coordinates, resulting in segmentation fault or potential memory corruption.

Why it matters to the business

Processing of untrusted PDF documents can trigger application crashes or instability, interrupting document workflows and potentially exposing systems to further compromise if memory corruption is leveraged.

How an attack unfolds

An attacker crafts a malicious PDF with text elements positioned at extreme y coordinates, then delivers it to a target who opens the file using pdftotext or another Xpdf-based tool, triggering the invalid memory access during text extraction.

How to fix it

Upgrade to a patched version of Xpdf once available from the vendor; in the interim restrict use of pdftotext and similar utilities on untrusted PDFs or replace with alternative PDF text extractors that do not exhibit this behavior.

How to confirm the fix worked

Test the fixed build against the original proof-of-concept PDF samples to confirm absence of segmentation faults; monitor vendor release notes for explicit resolution of the TextOutputDev.cc issue.

Typical attack path

  1. Craft PDF with text at large y coordinates to trigger mishandling in TextLine processing
  2. Deliver the PDF via email, web download, or shared storage
  3. Victim executes pdftotext or equivalent Xpdf utility against the file
  4. Invalid memory access occurs during extraction, causing crash or corruption

How to detect it

Review system logs and crash reports for segmentation faults originating from pdftotext or Xpdf binaries; correlate with file access events involving recently received PDF documents.

  • pdftotext segmentation fault
  • TextOutputDev.cc crash
  • invalid memory access in TextLine

What your security team should do

  • Prioritize removal or sandboxing of Xpdf tools from environments that routinely handle external PDFs
  • Implement content filtering or sandbox detonation for PDF processing workflows
  • Track upstream Xpdf releases for availability of a corrected build

The record

There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinates. It can be triggered by (for example) sending a crafted pdf file to the pdftotext binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.

Affected packages

Ecosystem Package Introduced Fixed
Mageia:9 xpdf 0 4.05-1.mga9
Ubuntu:16.04:LTS ipe 0 No fix
Ubuntu:18.04:LTS ipe 0 No fix
Ubuntu:20.04:LTS ipe 0 No fix
Ubuntu:22.04:LTS ipe 0 No fix
Ubuntu:24.04:LTS ipe 0 No fix
Ubuntu:24.10 ipe 0 No fix
Ubuntu:25.04 ipe 0 No fix
Ubuntu:25.10 ipe 0 No fix
Ubuntu:Pro:16.04:LTS ipe 0 No fix
Ubuntu:Pro:18.04:LTS ipe 0 No fix
Ubuntu:Pro:20.04:LTS ipe 0 No fix

Related vulnerabilities