CVE-2022-30524: Xpdfreader Xpdf

High severity, CVSS 7.8. EPSS: 1.6% chance of exploitation in the next 30 days.

There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinates. It can be triggered by (for example) sending a crafted pdf file to the pdftotext binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.

Affected products

• Xpdfreader Xpdf: version 4.0.4 only

Published 2022-05-09. Last modified 2026-06-17.