CVE-2022-43071

What it actually does

Stack-based buffer overflow in Catalog::readPageLabelTree2 allows an attacker-supplied PDF page label tree to overwrite the stack and crash the process.

Why it matters to the business

Users cannot open or view affected PDF documents without the application terminating, interrupting document workflows and review processes.

How an attack unfolds

An attacker crafts a PDF containing an oversized or malformed page label tree, then delivers the file to a victim who opens it with the vulnerable XPDF binary; the overflow occurs during parsing and immediately terminates the viewer.

How to fix it

Upgrade to the latest XPDF release that resolves the stack overflow in page label tree parsing; if an update is unavailable, switch to an alternative PDF viewer until a fix is released.

How to confirm the fix worked

Confirm the installed XPDF binary version is newer than 4.04 and test that the previously crashing crafted PDF no longer terminates the process.

Typical attack path

1. Create malicious PDF with oversized page label tree
2. Deliver file via email, web download, or shared storage
3. Victim opens the file with vulnerable XPDF binary
4. readPageLabelTree2 processes the tree and overflows the stack
5. Process crashes, producing denial of service

How to detect it

Monitor process crash logs and application fault reports for XPDF terminations that occur immediately after a PDF is opened; correlate with recent receipt of PDF files from untrusted sources.

What your security team should do

• Block or sandbox untrusted PDFs until XPDF is updated
• Replace XPDF with a maintained viewer that has received security patches
• Add PDF file type to application allow-list only after verifying the fix