CVE-2021-36978: Qpdf Project Qpdf

Medium severity, CVSS 5.5. EPSS: 1.3% chance of exploitation in the next 30 days.

QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.

Affected products

• Qpdf Project Qpdf: from 9.0.0, up to and including 9.1.1; from 10.0.0, up to and including 10.0.4

Published 2021-07-20. Last modified 2026-06-17.