CVE-2022-38234

What it actually does

Triggers a segmentation violation (crash) inside Lexer::getObj when parsing a specially malformed PDF object stream.

Why it matters to the business

Users who open attacker-supplied PDF files with the affected viewer experience an immediate application crash, halting document access and any automated PDF processing workflows.

How an attack unfolds

An attacker crafts a minimal PDF containing an object that forces Lexer::getObj into an invalid state, then delivers the file to a target who opens it locally with xpdf, resulting in an immediate segmentation fault.

How to fix it

Upgrade to a version of xpdf that post-dates commit ffaf11c or apply a source-level patch that adds bounds checks before object parsing in Lexer.cc; until fixed, avoid opening untrusted PDFs with the vulnerable binary.

How to confirm the fix worked

Rebuild with the patch and confirm the binary no longer crashes when opening the original proof-of-concept PDF; monitor process exit status and core dumps for the Lexer::getObj symbol.

Typical attack path

1. Generate a PDF file containing a malformed object that reaches the vulnerable code path in Lexer.cc
2. Host or transmit the file via email, web download, or shared storage
3. Victim opens the file using an affected xpdf binary
4. Lexer::getObj dereferences invalid memory and the process terminates

How to detect it

Search application crash logs, core-dump directories, and system event logs for abrupt terminations of the xpdf process that reference Lexer.cc or getObj; correlate with recent file-open events for PDFs received from external sources.

• segmentation violation.*Lexer::getObj
• /xpdf/Lexer.cc
• xpdf core dumped

What your security team should do

• Block untrusted PDF files from reaching user desktops until a patched xpdf binary is deployed
• Add the vulnerable Lexer.cc path to internal static-analysis rules to catch similar issues in future builds
• Update incident-response playbooks to treat unexpected xpdf crashes on PDF open as potential exploitation attempts