CVE-2024-7868: Xpdfreader Xpdf

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. The proof-of-concept PDF file causes a segfault attempting to read from an invalid address.

Affected products

• Xpdfreader Xpdf: before 4.06 (fixed in 4.06)

Published 2024-08-15. Last modified 2026-06-17.