CVE-2024-7868

What it actually does

Invalid DCT header information in a JPEG stream within a PDF causes an uninitialized variable in the decoder, resulting in a segmentation fault on an invalid memory read.

Why it matters to the business

Applications handling PDFs may crash when opening crafted files, interrupting document workflows with minimal operational disruption given the local attack requirements and absence of known exploitation.

How an attack unfolds

An attacker creates a PDF containing a JPEG stream with malformed DCT headers. When processed by a vulnerable decoder the uninitialized variable leads to a read from an invalid address and a crash.

How to fix it

Upgrade affected packages to the fixed versions libksba 1.5.1-6.el9_1 (and libksba-devel 1.5.1-6.el9_1) on AlmaLinux 9; apply equivalent updates for any Xpdf installations beyond version 4.05.

How to confirm the fix worked

Re-test with the published proof-of-concept PDF after patching to confirm absence of the segmentation fault; verify package versions match the listed fixed releases.

Typical attack path

1. Craft a PDF containing a JPEG stream with invalid DCT header data
2. Deliver the file to a target system
3. Induce the victim to open the PDF in an affected viewer or library
4. Trigger the decoder path that reads the uninitialized variable, causing a segfault

How to detect it

Inspect system and application logs for segmentation faults or crashes occurring during PDF or JPEG stream processing; correlate with file open events involving untrusted documents.

What your security team should do

• Apply the specified package updates on all AlmaLinux 9 systems
• Prioritize patching in environments that routinely process untrusted PDFs
• Review logging for unexpected crashes during PDF handling as a temporary detection measure