CVE-2009-1182: Apple Cups

High severity, CVSS 7.5. EPSS: 7.3% chance of exploitation in the next 30 days.

Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.

Affected products

• Apple Cups: up to and including 1.3.9; version 1.1 only; version 1.1.1 only; version 1.1.2 only; version 1.1.3 only; version 1.1.4 only; …
• Foolabs Xpdf: version 0.5a only; version 0.7a only; version 0.91a only; version 0.91b only; version 0.91c only; version 0.92a only; …
• Glyphandcog Xpdfreader: up to and including 3.02; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; version 0.6 only; …
• Poppler Poppler: up to and including 0.10.5; version 0.1 only; version 0.1.1 only; version 0.1.2 only; version 0.2.0 only; version 0.3.0 only; …

Published 2009-04-23. Last modified 2026-06-16.