CVE-2022-36561

What it actually does

The vulnerability triggers a segmentation violation during AcroForm structure parsing at AcroForm.cc:538, causing invalid memory access and application crash when processing a crafted PDF.

Why it matters to the business

Attackers can force denial of service against users or automated workflows that rely on XPDF to open PDF documents, interrupting document review or processing tasks.

How an attack unfolds

An attacker prepares a PDF embedding a malformed AcroForm that triggers the crash condition; the file is delivered to the victim who opens it locally with XPDF, resulting in immediate segmentation fault and application termination.

How to fix it

Upgrade XPDF to the latest available version once a fix is released; in the interim replace XPDF with an alternative PDF viewer or sandbox PDF processing.

How to confirm the fix worked

Reproduce the issue with proof-of-concept PDFs that exercise AcroForm parsing; confirm absence of crash after applying updates and review changelog entries for AcroForm.cc modifications.

Typical attack path

1. Create malicious PDF containing malformed AcroForm data
2. Deliver the PDF to the target via email attachment or web download
3. Victim opens the PDF using XPDF on a local system
4. AcroForm parsing code dereferences invalid memory and crashes

How to detect it

Review system and application logs for segmentation fault entries occurring immediately after PDF file access; correlate crash timestamps with XPDF process execution on systems where the reader is installed.

What your security team should do

• Replace XPDF with a maintained PDF viewer in all environments
• Block or sandbox untrusted PDFs before they reach end-user systems
• Monitor vendor announcements for an official patch and apply immediately