CVE-2011-1552: Foolabs Xpdf

Medium severity, CVSS 4.3. EPSS: 10.4% chance of exploitation in the next 30 days.

t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

Affected products

• Foolabs Xpdf: version 0.5a only; version 0.7a only; version 0.91a only; version 0.91b only; version 0.91c only; version 0.92a only; …
• Glyphandcog Xpdfreader: up to and including 3.02; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; version 0.6 only; …
• t1lib t1lib: up to and including 5.1.2; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …

Published 2011-03-31. Last modified 2026-06-16.