CVE-2018-8036: Apache Pdfbox

Medium severity, CVSS 6.5. EPSS: 4.8% chance of exploitation in the next 30 days.

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

Affected products

• Apache Pdfbox: after 1.8.0, up to and including 1.8.14; from 2.0.0, up to and including 2.0.10; version 2.0.0 only

Published 2018-07-03. Last modified 2026-06-17.