CVE-2023-3436

What it actually does

Deadlock during PDF parsing when an object stream's Length field resides inside another object stream, causing the parser to wait indefinitely for resolution.

Why it matters to the business

PDF viewing or processing workflows using the affected reader may hang, interrupting document access with minimal other operational effects.

How an attack unfolds

An attacker creates a PDF containing nested object streams where the Length field is deferred, then delivers the file to a target who opens it in the vulnerable reader, triggering the deadlock condition.

How to fix it

Upgrade to a patched version of Xpdf once released; in the interim, avoid opening untrusted PDF files with Xpdf and consider alternative readers.

How to confirm the fix worked

Test the reader against a sample PDF containing a deferred Length field in an object stream and confirm the process no longer deadlocks; verify the installed version against future fixed releases.

Typical attack path

1. Craft a PDF with a Length field located inside a secondary object stream
2. Deliver the malicious PDF via email, web download, or shared storage
3. Victim opens the file using the affected Xpdf version
4. Parser enters deadlock state and the application becomes unresponsive

How to detect it

Review system process lists and logs for Xpdf instances that remain in a running but unresponsive state after PDF file access; correlate with file-open events for recently received PDFs.

What your security team should do

• Monitor upstream Xpdf releases for a fix and schedule prompt upgrades
• Configure application allow-listing or sandboxing for PDF handling
• Educate users to treat unexpected PDFs with caution