CVE-2022-41842

What it actually does

Invalid file seek operation in gfseek(_IO_FILE*, long, int) within goo/gfile.cc triggers a crash (memory corruption family) when processing a malformed PDF, resulting in local denial of service with no confidentiality or integrity impact.

Why it matters to the business

Xpdf users experience sudden application termination when opening certain PDF documents, interrupting document review workflows and requiring restarts or alternative viewers; low exploitability and absence from KEV or ransomware campaigns limit widespread operational risk despite the four-year-old disclosure.

How an attack unfolds

An attacker prepares a PDF that causes an invalid seek call during file parsing; when a victim opens the file locally with Xpdf 4.04, the crash occurs immediately in gfseek without requiring network access or elevated privileges.

How to fix it

Upgrade Xpdf to the latest available release that resolves the gfseek crash; if no newer package is provided by the distribution, migrate to an alternative PDF viewer such as poppler-based tools or Adobe Reader.

How to confirm the fix worked

Confirm Xpdf version is newer than 4.04, then attempt to open a known triggering PDF and verify the application remains stable without crashing in gfseek.

Typical attack path

1. Craft a PDF that triggers the invalid seek condition in goo/gfile.cc
2. Deliver the file via email, web download, or removable media
3. Victim opens the PDF using Xpdf 4.04 on a local system
4. Application crashes, producing denial of service

How to detect it

Review application crash logs, core dumps, or system event logs for Xpdf processes terminating during PDF file operations; correlate with recent file opens of suspicious PDFs.

What your security team should do

• Replace Xpdf 4.04 with a maintained PDF viewer across all endpoints
• Add Xpdf crash monitoring to endpoint detection rules
• Block or sandbox untrusted PDF files until migration is complete