CVE-2019-12958: Glyphandcog Xpdfreader

Medium severity, CVSS 5.5. EPSS: 1.2% chance of exploitation in the next 30 days.

In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in FoFiType1C::convertToType0 in fofi/FoFiType1C.cc when it is trying to access the second privateDicts array element, because the privateDicts array has only one element allocated.

Affected products

• Glyphandcog Xpdfreader: version 4.01.01 only

Published 2019-06-25. Last modified 2026-06-17.