CVE-2022-38171

HIGH 7.8CVE-2022-38171 · Published 22/08/2022 · updated 17/06/2026

In short

CVE-2022-38171 is a HIGH (CVSS 7.8) vulnerability affecting poppler (freedesktop), xpdf (xpdfreader).
Chance of exploitation in the next 30 days (EPSS): 0.34%, higher than 27.6% of all vulnerabilities.
Fix: update to 22.09.0 or later.

Package	Affected versions	Patched versions
poppler freedesktop	`< 22.09.0`	`22.09.0`
xpdf xpdfreader	`= 4.04`	No fix yet

Description

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).

References

openwall.com/lists/oss-security/2022/09/02/11 · Mailing List
xpdfreader.com/security-fixes.html · Vendor Advisory
dl.xpdfreader.com/xpdf-4.04.tar.gz · Vendor Advisory
jeffssh/CVE-2021-30860 · Third Party Advisory
zmanion/Vulnerabilities · Patch
googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html · Third Party Advisory
cve.org/CVERecord · Third Party Advisory

More vulnerabilities in poppler

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

poppler

freedesktop

< 22.09.0

22.09.0

xpdf

xpdfreader

= 4.04

No fix yet

Description

More vulnerabilities in poppler

See all →