CVE-2022-43295

What it actually does

Stack-based buffer overflow in FileStream::copy() during PDF stream processing allows memory corruption on the stack, resulting in application crash or potential local code execution.

Why it matters to the business

Users opening crafted PDF files experience application crashes that interrupt document viewing workflows and may require restarts or alternative readers.

How an attack unfolds

An attacker creates a malicious PDF containing a specially crafted stream that triggers the overflow in FileStream::copy when parsed; the victim opens the file locally with the vulnerable XPDF binary, causing the crash or memory corruption.

How to fix it

Upgrade to a patched version of XPDF once available; in the interim, avoid opening untrusted PDF files with XPDF and use alternative PDF readers with sandboxing.

How to confirm the fix worked

Confirm the installed XPDF binary is newer than 4.04 and test that opening known-malformed test PDFs no longer triggers crashes or segmentation faults in FileStream::copy.

Typical attack path

1. Attacker generates PDF with oversized or malformed stream data targeting Stream.cc:795
2. Victim receives and opens the PDF file using XPDF on their local system
3. FileStream::copy() is invoked during parsing, overflowing the stack buffer
4. Process crashes or memory state is corrupted, achieving denial of service or limited code execution

How to detect it

Review endpoint logs or crash dumps for XPDF segmentation faults or stack overflow signals when PDF files are opened; correlate file open events with process termination.

What your security team should do

• Block or sandbox XPDF usage on endpoints until a fixed build is deployed
• Add PDF file-type restrictions or warnings in email and web gateways
• Monitor for XPDF process crashes in endpoint telemetry