CVE-2023-3436: Xpdfreader Xpdf

Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream.

Affected products

• Xpdfreader Xpdf: version 4.04 only

Published 2023-06-27. Last modified 2026-06-17.