CVE-2022-38222

What it actually does

Use-after-free in JBIG2Stream::close() within JBIG2Stream.cc allows memory corruption when a crafted PDF is processed by Xpdf tools such as pdfimages.

Why it matters to the business

Attackers can crash PDF processing applications or potentially execute arbitrary code on systems handling untrusted PDF files, disrupting workflows that rely on Xpdf for document conversion or extraction.

How an attack unfolds

An attacker creates a specially crafted PDF that triggers the use-after-free condition in JBIG2 handling; the victim then opens or processes the file locally using an affected Xpdf binary, resulting in denial of service or further memory manipulation.

How to fix it

Upgrade Xpdf to the latest available version that resolves the JBIG2Stream issue; if no update exists, replace Xpdf with an alternative PDF tool or isolate its use to trusted files only.

How to confirm the fix worked

Verify the installed Xpdf version against known patched releases, test processing of sample PDFs that previously triggered the flaw, and confirm absence of crashes or memory errors under controlled conditions.

Typical attack path

1. Create a malicious PDF exploiting the JBIG2 use-after-free in JBIG2Stream::close()
2. Deliver the PDF to the target via email, web download, or shared storage
3. Victim invokes an affected Xpdf binary such as pdfimages on the file
4. Trigger the use-after-free to cause crash or attempt code execution

How to detect it

Review system and application logs for segmentation faults or abnormal terminations of pdfimages and xpdf processes when handling PDF files; correlate with file creation or access events involving external PDFs.

What your security team should do

• Block or sandbox Xpdf execution against untrusted PDFs
• Replace Xpdf with maintained alternatives in enterprise workflows
• Add PDF file-type restrictions to email and download gateways
• Monitor process crashes involving pdfimages or xpdf binaries