CVE-2024-56378

What it actually does

Out-of-bounds read in JBIG2Bitmap::combine within JBIG2Stream.cc allows a malformed JBIG2 stream in a PDF to access memory beyond allocated bitmap buffers, resulting in either a process crash or unintended memory disclosure.

Why it matters to the business

Applications that render or process PDFs using this library may crash unexpectedly or leak small amounts of process memory, disrupting document workflows and potentially exposing sensitive data in environments that handle untrusted PDFs.

How an attack unfolds

An attacker crafts a PDF containing a specially malformed JBIG2 image stream, delivers it to a target system, and waits for the victim application to parse the file; when JBIG2Bitmap::combine executes, the out-of-bounds read occurs and the attacker observes either a crash or extracts leaked memory contents.

How to fix it

Upgrade Poppler to the commit ade9b5ebed44b0c15522c27669ef6cdf93eff84e or later; rebuild and redeploy all dependent applications; test PDF rendering with known malformed JBIG2 test cases after update.

How to confirm the fix worked

Confirm the installed libpoppler.so reports a build containing commit ade9b5ebed44b0c15522c27669ef6cdf93eff84e; run regression tests that exercise JBIG2 decoding paths; monitor application stability when processing the original proof-of-concept PDF.

Typical attack path

1. Create malicious PDF embedding crafted JBIG2 stream
2. Deliver file via email, web download, or shared storage
3. Victim application opens or previews the PDF
4. JBIG2Stream.cc parsing invokes combine function
5. Out-of-bounds read triggers crash or memory disclosure

How to detect it

Review application and system logs for segmentation faults or abnormal exits during PDF processing; search for repeated invocations of poppler or libpoppler in crash reports; correlate file-open events with subsequent process termination when the file contains JBIG2 streams.

What your security team should do

• Prioritize upgrade of Poppler in all desktop, server, and container images that process PDFs
• Add Poppler version checks to software bill-of-materials and vulnerability scanning pipelines
• Restrict opening of PDFs from untrusted sources until patches are deployed
• Update incident response playbooks to treat unexpected PDF renderer crashes as potential memory-corruption events