CVE-2022-30775

What it actually does

The flaw causes xpdf 4.04 to allocate excessive memory when processing specially crafted PDF input, leading to resource exhaustion and denial of service.

Why it matters to the business

PDF processing tools become unresponsive or crash under load from malicious documents, disrupting document workflows, scanning pipelines, and any automated systems that rely on xpdf for rendering or conversion.

How an attack unfolds

An attacker prepares a malicious PDF that triggers uncontrolled memory allocation inside xpdf. The document is delivered to a target system or service that invokes binaries such as pdftoppm. Upon opening or converting the file, the process consumes large amounts of memory until the system or application becomes unavailable. Publicly available exploit code can be used to generate such PDFs.

How to fix it

Replace xpdf 4.04 with a later maintained version of xpdf or switch to an alternative PDF rendering library that does not exhibit the same memory behavior. Apply operating-system resource limits to PDF-processing processes, run them inside containers with memory caps, and restrict execution of xpdf binaries to trusted input sources only.

How to confirm the fix worked

Confirm the installed xpdf version is newer than 4.04 or replaced entirely. Test the environment by feeding known memory-exhaustion PDFs in an isolated sandbox and verify that memory usage remains bounded and no crash occurs.

Typical attack path

1. Generate a crafted PDF using publicly available techniques that force excessive memory allocation in xpdf.
2. Deliver the PDF via email, web download, or shared storage to a system running xpdf or dependent tools.
3. Trigger processing by invoking pdftoppm or another xpdf binary on the file, either manually or through automated workflows.
4. Observe memory exhaustion causing the process or host to become unresponsive or crash.

How to detect it

Search process and system logs for xpdf or pdftoppm instances that terminate abnormally or consume unusually high memory. Review security and application logs for repeated invocations of xpdf binaries on files originating from external sources.

What your security team should do

• Inventory all systems and pipelines that invoke xpdf or pdftoppm and prioritize removal or replacement where possible.
• Implement strict input validation and sandboxing around any remaining xpdf usage.
• Monitor for high-memory processes associated with PDF handling and set alerts for anomalous resource consumption.
• Block or quarantine PDF files from untrusted sources until safer tooling is deployed.