CVE-2022-45586

What it actually does

Stack-based buffer overflow in xpdf Dict::find allows an attacker-supplied PDF dictionary to overwrite the call stack, resulting in a crash and denial of service.

Why it matters to the business

Local users or automated processes that parse untrusted PDFs can trigger application or service crashes, causing operational disruption and potential loss of availability for PDF-dependent workflows; the affected Centreon codebase requires an update to the listed commit to eliminate the exposure.

How an attack unfolds

An attacker crafts a malicious PDF containing an oversized or malformed dictionary entry that triggers the vulnerable Dict::find code path; the file is then opened locally (via UI interaction or automated processing) causing the stack overflow and immediate crash with no further code execution or persistence.

How to fix it

Update the Centreon codebase to the commit 2dd129a167398b1c65a62f4e4e2ef7717bffe41b or later; rebuild and redeploy any affected packages; replace any bundled xpdf 4.04 binaries with patched versions.

How to confirm the fix worked

Confirm the presence of commit 2dd129a167398b1c65a62f4e4e2ef7717bffe41b in the source tree; recompile and test that the Dict::find function no longer exhibits stack overflow on crafted inputs; verify runtime behavior with known-bad PDF test cases.

Typical attack path

1. Identify or obtain access to a system running the vulnerable xpdf-based PDF parser
2. Prepare a specially crafted PDF that exercises the Dict::find stack overflow
3. Cause the target application or service to open or process the PDF (local file open or automated ingestion)
4. Trigger the overflow resulting in denial of service

How to detect it

Review application and system logs for unexpected crashes or segmentation faults occurring during PDF processing; correlate timestamps of crashes with file ingestion or user-initiated PDF opens; examine core dumps or stack traces referencing Dict::find or xpdf code.

What your security team should do

• Apply the listed commit immediately on all development, build, and production Centreon instances
• Inventory all systems that embed or call xpdf 4.04 and schedule upgrades
• Add PDF parsing to the list of components scanned by software composition analysis
• Monitor for new xpdf releases and re-evaluate EPSS and exploit availability