Description Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration Affected Products Product Versions foolabs xpdf 3.02pl1
3.02pl2
3.02pl3
CPE cpe:2.3:a:foolabs:xpdf:3.02pl1:*:*:*:*:*:*:* cpe:2.3:a:foolabs:xpdf:3.02pl2:*:*:*:*:*:*:* cpe:2.3:a:foolabs:xpdf:3.02pl3:*:*:*:*:*:*:* Remediation No remediation found in references. glyphandcog xpdfreader 3.00
3.01
3.02
CPE cpe:2.3:a:glyphandcog:xpdfreader:3.00:*:*:*:*:*:*:* cpe:2.3:a:glyphandcog:xpdfreader:3.01:*:*:*:*:*:*:* cpe:2.3:a:glyphandcog:xpdfreader:3.02:*:*:*:*:*:*:* Remediation No remediation found in references. poppler poppler <= 0.12.0
0.1
0.1.1
0.1.2
0.2.0
0.3.0
0.3.1
0.3.2
0.3.3
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.6
0.8.7
0.9.0
0.9.1
0.9.2
0.9.3
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.5
0.10.6
0.10.7
0.11.0
0.11.1
0.11.2
0.11.3
Viewing 5 of 52 versions. View all CPE cpe:2.3:a:poppler:poppler:*:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.1:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.1.1:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.1.2:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.2.0:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.3.0:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.3.1:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.3.2:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.3.3:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.4.0:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.4.1:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.4.2:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.4.3:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.4.4:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.5.0:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.5.1:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.5.2:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.5.3:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.5.4:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.5.9:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.6.0:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.6.1:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.6.2:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.6.3:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.6.4:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.7.0:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.7.1:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.7.2:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.7.3:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.8.0:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.8.1:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.8.2:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.8.3:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.8.4:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.8.6:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.8.7:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.9.0:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.9.1:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.9.2:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.9.3:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.10.0:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.10.1:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.10.2:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.10.3:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.10.4:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.10.5:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.10.6:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.10.7:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.11.0:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.11.1:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.11.2:*:*:*:*:*:*:* cpe:2.3:a:poppler:poppler:0.11.3:*:*:*:*:*:*:* Remediation No remediation found in references. glyph and cog pdftops All versions
CPE cpe:2.3:a:glyph_and_cog:pdftops:*:*:*:*:*:*:*:* Remediation No remediation found in references. gnome gpdf All versions
CPE cpe:2.3:a:gnome:gpdf:*:*:*:*:*:*:*:* Remediation No remediation found in references. kde kpdf All versions
CPE cpe:2.3:a:kde:kpdf:*:*:*:*:*:*:*:* Remediation No remediation found in references. tetex tetex All versions
CPE cpe:2.3:a:tetex:tetex:*:*:*:*:*:*:*:* Remediation No remediation found in references.
Change History 12 change records found show changes
Date Action Recorded By Jun 16, 2026 CVE Modified [email protected] Apr 23, 2026 Status Change [email protected] Nov 21, 2024 CVE Modified CVE May 14, 2024 CVE Modified [email protected] Feb 13, 2023 CVE Modified [email protected] Feb 2, 2023 CVE Modified [email protected] Mar 6, 2019 CPE Deprecation Remap [email protected] Mar 6, 2019 CPE Deprecation Remap [email protected] Mar 6, 2019 CPE Deprecation Remap [email protected] Sep 19, 2017 CVE Modified [email protected] Aug 17, 2017 CVE Modified [email protected] Oct 22, 2009 Initial Analysis [email protected]