CVE-2023-2664

What it actually does

Malformed PDF embedded file tree containing an object loop triggers unbounded recursion during parsing, exhausting stack memory and causing process termination.

Why it matters to the business

Local users lose the ability to open or render affected PDFs, interrupting document workflows and requiring restarts or alternative viewers; long-term unpatched installations remain exposed given the public exploit.

How an attack unfolds

An attacker prepares a PDF whose embedded file references form a cycle, then convinces the victim to open the file locally; the parser recurses until the stack overflows and the application crashes, achieving denial of service. Public exploit code has been available since disclosure.

How to fix it

Replace Xpdf 4.04 and earlier with a later release that resolves the recursion flaw; where an upgrade is unavailable, switch to an alternative PDF reader that does not exhibit the same parsing behavior.

How to confirm the fix worked

Attempt to open a test PDF containing an embedded-file loop in the updated binary and confirm the application remains stable without stack overflow or crash.

Typical attack path

1. Craft malicious PDF with cyclic embedded-file object references
2. Deliver the file via email, web download, or shared storage
3. Victim opens the document in the vulnerable Xpdf binary
4. Parser enters infinite recursion on the embedded file tree
5. Stack exhaustion terminates the process

How to detect it

Review file-open logs and crash reports for repeated Xpdf terminations shortly after PDF access; search endpoint telemetry for execution of the xpdf binary against untrusted documents.

What your security team should do

• Prioritize removal or upgrade of Xpdf 4.04 and earlier on all endpoints
• Block or sandbox untrusted PDFs until readers are updated
• Add the vulnerable Xpdf binary to application allow-lists only after patching
• Monitor for new fixed releases from the vendor