CVE-2025-55197

What it actually does

This is a denial-of-service vulnerability triggered by a specially crafted PDF. The malicious file abuses a sequence of FlateDecode filters on a PDF cross-reference stream, causing excessive decompression or repeated stream processing that exhausts available RAM when the file is read. Other PDF content streams may also trigger the issue when explicitly accessed. The expected impact is process termination, service instability, or host-level memory pressure rather than code execution or data theft.

Why it matters to the business

Successful exploitation can disrupt services or workflows that preview, scan, index, upload, email, archive, or otherwise process PDF files. A single malicious document may cause a vulnerable process to consume memory until it crashes or is killed, potentially delaying document processing, interrupting user-facing services, or degrading shared infrastructure. The vulnerability is not currently listed in CISA KEV, is not associated with ransomware use, and has low EPSS probability, but it has been public for 362 days, so exposed PDF-processing paths should still be patched or isolated. Alpine v3.19 and v3.20 deployments using the affected intel-ucode package should be updated to the fixed 20250812-r0 release.

How an attack unfolds

An attacker prepares a PDF whose internal cross-reference stream contains a malicious chain of FlateDecode filters designed to expand or process in a way that consumes excessive memory. The attacker then delivers the file through any path that causes a vulnerable component to read or inspect the PDF, such as upload portals, email attachments, document preview services, file indexing, antivirus/content scanning, or automated conversion pipelines. When the vulnerable software parses the cross-reference stream, memory usage grows rapidly. The affected process may crash, be terminated by the operating system OOM killer, or cause broader service degradation if resource controls are not in place. Exploitation does not require user interaction beyond the file being opened, previewed, scanned, or otherwise processed by the vulnerable component.

How to fix it

Upgrade affected Alpine packages to the fixed release. For Alpine v3.19 and Alpine v3.20, update intel-ucode to 20250812-r0 or later. Remove duplicate or stale package pins that prevent the fixed version from being installed. Where PDF processing is exposed to untrusted files, also apply defense-in-depth controls: run PDF parsers and converters in containers or sandboxes, enforce per-process memory limits, set upload size and decompression limits, disable unnecessary automatic PDF preview/conversion, and isolate document-processing workers from critical services. If the package update requires a reboot or reload to become effective on the platform, schedule and complete that operational step.

How to confirm the fix worked

Confirm package remediation by checking that affected Alpine v3.19 and v3.20 systems report intel-ucode version 20250812-r0 or later, for example through package inventory, image manifests, software composition analysis, or `apk info -v intel-ucode`. Rebuild and redeploy container/base images that inherited the vulnerable package. Validate exposure by identifying services that automatically read PDFs from untrusted sources and confirming they run with memory limits and isolation. Where safe and authorized, test using non-malicious large or malformed PDFs in a staging environment to ensure the parser fails closed without exhausting host memory. Review vulnerability scanner results to verify the CVE is no longer reported after package updates and image redeployment.

Typical attack path

1. Identify an application or workflow that accepts, previews, scans, indexes, converts, or otherwise reads PDF files.
2. Create a malicious PDF with a cross-reference stream using repeated or abusive FlateDecode filters.
3. Deliver the PDF through an accepted input path such as file upload, email attachment, shared storage, or document-processing queue.
4. Wait for the vulnerable component to parse the PDF metadata or access affected content streams.
5. Cause rapid memory exhaustion, leading to process crash, OOM termination, service restart, or degraded availability.

How to detect it

This vulnerability causes denial of service rather than reliable post-exploitation persistence, so investigation should focus on evidence of malicious PDF handling followed by memory exhaustion or process crashes. Review application logs for PDF upload, preview, conversion, indexing, scanning, or email-processing activity immediately before OOM events, worker restarts, HTTP 500 errors, queue backlogs, or container terminations. Examine system logs such as syslog, journald, kernel logs, container runtime events, Kubernetes events, EDR telemetry, and application crash reports for `Out of memory`, `Killed process`, `oom-killer`, or abnormal memory growth tied to PDF-processing components. Preserve suspicious PDFs and inspect them offline for cross-reference streams using `/Type /XRef` and repeated `/FlateDecode` filters. For SIEM correlation, alert when a PDF-processing service reads a newly received PDF and is killed for memory exhaustion within a short time window. Threat actor exploitation is not currently reported in the provided intelligence, and the CVE is not listed in CISA KEV, so absence of known actor tradecraft should not be treated as proof of non-exploitation.

• /FlateDecode
• /Type /XRef
• /XRef
• %PDF-
• Out of memory
• Killed process
• oom-killer
• Cannot allocate memory
• OOMKilled
• CrashLoopBackOff

What your security team should do

• Inventory Alpine v3.19 and v3.20 assets and images containing intel-ucode and prioritize updates to 20250812-r0 or later.
• Identify externally reachable or high-volume PDF ingestion paths and ensure they are patched, sandboxed, and memory-limited.
• Rebuild base images and downstream workloads that may continue to carry the vulnerable package even after repository updates.
• Add monitoring for OOM events and PDF-processing crashes, especially in document upload, preview, indexing, mail, and scanning services.
• Apply file-processing hardening: maximum file size, maximum decompressed size, parser timeouts, worker isolation, and automatic restart with rate limiting.
• Because there is no KEV listing, no known ransomware association, low EPSS, and no mature public exploit indicated, handle as a standard-priority availability fix unless the environment processes untrusted PDFs at scale.