CVE-2022-38230

What it actually does

A floating point exception in DCTStream::decodeImage triggers an unhandled crash during processing of malformed DCT-encoded image data inside PDF streams.

Why it matters to the business

Users opening crafted PDF files experience an immediate application crash, interrupting document review workflows and potentially halting business processes that rely on PDF viewing or conversion.

How an attack unfolds

An attacker creates a PDF containing a specially malformed DCT image stream. When the victim opens the file with the vulnerable XPDF binary, the decoder hits the floating-point exception and terminates, achieving denial of service. Public exploit code is available and the issue has been known for over four years.

How to fix it

Upgrade to a maintained fork or alternative PDF viewer that has addressed the floating-point exception. Disable PDF rendering in high-risk workflows until a patched version is deployed.

How to confirm the fix worked

Attempt to open a test PDF containing the known malformed DCT stream; confirm the application no longer crashes and returns a clean error or renders the page safely.

Typical attack path

1. Attacker crafts PDF with invalid DCT image data
2. Victim receives and opens the PDF (local file, email attachment, or web download)
3. XPDF loads the document and invokes DCTStream::decodeImage
4. Floating-point exception occurs and the process crashes

How to detect it

Monitor process crash logs and application fault reports for XPDF binaries encountering floating-point exceptions while parsing PDF streams; correlate with file-open events on untrusted documents.

What your security team should do

• Replace XPDF with a supported viewer in all environments
• Block untrusted PDFs from being opened in automated or unattended processes
• Add file-type sandboxing or conversion steps before user viewing