PT-2024-38643 · Xpdf+1 · Xpdf+1

Xiaobaozidi · Published 2024-08-15 · Updated 2025-12-22 · CVE-2024-7866

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xpdf versions 4.05 and earlier

Description The issue is caused by a PDF object loop in a pattern resource, leading to infinite recursion and a stack overflow. This could allow attackers to crash the system or expose data.

Recommendations For Xpdf versions 4.05 and earlier, patch immediately to prevent potential exploitation. Monitor for exploits and apply the patch as soon as possible to minimize the risk of a stack overflow due to infinite recursion.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALT-PU-2025-16036

CVE-2024-7866

Affected Products

Alt Linux

Xpdf

References · 11

• https://xpdfreader.com/security-bug/object-loops.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-7866 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7866 · Security Note
• https://ubuntu.com/security/CVE-2024-7866 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-7866 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-7866 · Security Note
• https://twitter.com/CVEnew/status/1824178277428424981 · Twitter Post
• https://t.me/cvenotify/91117 · Telegram Post
• https://t.me/cvenotify/91408 · Telegram Post
• https://twitter.com/oktsec/status/1825370668017369119 · Twitter Post
• https://t.me/cvedetector/3285 · Telegram Post