CVE-2022-41844

What it actually does

Memory corruption during PDF cross-reference table parsing causes an immediate process crash in XRef::fetch when a malformed PDF is opened locally.

Why it matters to the business

Users who open crafted PDF files with the affected reader experience an abrupt application crash, interrupting document workflows and potentially requiring restarts or alternative tools.

How an attack unfolds

An attacker prepares a specially malformed PDF that triggers the crash path in XRef::fetch. The victim opens the file locally with user interaction; the reader parses the cross-reference table, hits the corruption, and terminates without further code execution or data access.

How to fix it

Migrate to a maintained PDF reader or a newer version of Xpdf if one becomes available; disable or sandbox the affected reader in environments that must process untrusted PDFs.

How to confirm the fix worked

Attempt to open known-malformed test PDFs that previously triggered the crash and confirm the reader no longer terminates unexpectedly; monitor vendor announcements for any future patched releases.

Typical attack path

1. Craft malicious PDF targeting XRef parsing logic
2. Deliver file via email, download link, or shared storage
3. Victim opens file in vulnerable Xpdf reader
4. Parser encounters malformed cross-reference data
5. Process crashes due to memory corruption

How to detect it

Review system or application logs for unexpected terminations of the xpdf process when handling PDF files; look for crash dumps or segmentation faults originating from xpdf/XRef.cc around the fetch function.

• xpdf process crash with signal 11 or segmentation fault
• xpdf/XRef.cc in stack trace of core dump

What your security team should do

• Replace Xpdf with a supported PDF viewer across the organization
• Block or sandbox execution of the xpdf binary for untrusted files
• Add the reader to application allow-lists only where strictly required