CVE-2024-7867

What it actually does

Integer overflow when parsing very large page box coordinates triggers a divide-by-zero, resulting in a crash of the PDF processing application.

Why it matters to the business

Processing of crafted PDF files can cause the application to crash, interrupting document handling or automated workflows that rely on the library.

How an attack unfolds

An attacker creates a PDF containing extremely large coordinate values inside page boxes. When the vulnerable code parses these values an integer overflow occurs, followed by division by zero that terminates the process.

How to fix it

Upgrade Xpdf to a version newer than 4.05. For the listed AlmaLinux packages apply the provided fixed versions: sqlite 3.34.1-6.el9_1, sqlite-devel 3.34.1-6.el9_1, sqlite-libs 3.34.1-6.el9_1.

How to confirm the fix worked

Confirm the installed Xpdf or sqlite package versions match or exceed the fixed releases and test with known-large-coordinate PDFs to verify absence of crash.

Typical attack path

1. Generate a malicious PDF embedding oversized page-box coordinates
2. Deliver the file to a target system via email, download, or file share
3. Victim or automated process opens or renders the PDF using the affected library
4. Integer overflow and divide-by-zero crash the application

How to detect it

Review application crash logs and PDF processing error entries for sudden terminations when handling PDF files; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize patching systems that process untrusted PDFs
• Apply the exact fixed package versions supplied for AlmaLinux 9
• Monitor EPSS and KEV updates given the 787 days since publication