CVE-2022-38334

What it actually does

Stack-based buffer overflow in Catalog::countPageTree during PDF page tree parsing that results in application crash on malformed input.

Why it matters to the business

Document viewing workflows are interrupted by crashes when users open certain PDF files; no data loss or remote code execution occurs but productivity is affected until the reader is replaced.

How an attack unfolds

An attacker crafts a PDF with an excessively deep or malformed page tree that overflows the stack inside countPageTree. The file is opened locally by a user running XPDF 4.04 or earlier, triggering the crash and denial of service.

How to fix it

Migrate away from XPDF 4.04 and earlier to a maintained PDF reader; if XPDF must be retained, apply any subsequent upstream patches that correct the page-tree handling logic.

How to confirm the fix worked

Attempt to open the original proof-of-concept PDF and other deep page-tree test cases; confirm the application no longer crashes and that the function is absent or bounds-checked in the binary.

Typical attack path

1. Generate a PDF containing a page tree that triggers excessive recursion or oversized structures
2. Deliver the PDF to the target via email, web download, or file share
3. User opens the file with the vulnerable XPDF binary
4. Catalog::countPageTree overflows the stack and the process terminates

How to detect it

Inspect local crash reports, core dumps, and application logs for faults originating from Catalog.cc or the countPageTree symbol when PDF files are processed.

What your security team should do

• Remove or replace XPDF installations with a supported viewer
• Block execution of xpdf binaries older than the current release via application allow-listing
• Add PDF readers to the vulnerability scanning inventory and enforce regular updates