CVE-2023-2663

What it actually does

A crafted PDF containing a cyclic reference in the page label tree triggers unbounded recursion during parsing, exhausting the call stack and terminating the process.

Why it matters to the business

Users opening malicious PDFs experience an immediate crash of the viewer, interrupting document access and potentially halting workflows that rely on local PDF inspection.

How an attack unfolds

An attacker embeds a self-referential loop inside the PDF page-label dictionary; when a victim opens the file with Xpdf the parser follows the cycle, recurses until stack exhaustion occurs, and the application terminates.

How to fix it

Upgrade to the first patched release of Xpdf once published; until then, restrict Xpdf to trusted PDFs only and prefer alternative viewers for untrusted documents.

How to confirm the fix worked

Confirm Xpdf version is newer than 4.04; attempt to open a test PDF containing a page-label loop and verify the viewer remains stable without crashing.

Typical attack path

1. Craft PDF with cyclic page-label object references
2. Deliver file via email, download link, or shared storage
3. Victim opens the document with Xpdf 4.04 or earlier
4. Parser enters infinite recursion on page-label tree walk
5. Stack overflow aborts the process

How to detect it

Monitor process termination logs and application crash reports on endpoints running Xpdf for sudden exits while handling PDF files; correlate with file-open events for recently received documents.

What your security team should do

• Block untrusted PDFs from being opened with Xpdf until a fixed version is available
• Add Xpdf crash signatures to endpoint monitoring for rapid detection of attempted exploitation
• Communicate to users to avoid opening PDFs from unknown sources with this viewer