CVE-2019-16115
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction:...
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.
- Record
CVE-2019-16115- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.
- Record
CVE-2019-16115- Updated
- 2026-11-02
EUVDEUVD-2019-6956 No score
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.
- Record
EUVD-2019-6956- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fx8g-cgwg-pm6c No score
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction:...
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.
- Record
GHSA-fx8g-cgwg-pm6c- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-16115
In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.
- Record
UBUNTU-CVE-2019-16115- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2023:3241-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2019-16115: Fixed an uninitialized memory error in GfxUnivariateShading::setupCache. (bsc#1150039)
- Record
SUSE-SU-2023:3241-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3292-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2019-16115: Fixed an uninitialized memory error in GfxUnivariateShading::setupCache. (bsc#1150039)
- Record
SUSE-SU-2023:3292-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3303-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2019-16115: Fixed an uninitialized memory error in GfxUnivariateShading::setupCache. (bsc#1150039)
- Record
SUSE-SU-2023:3303-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3399-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2019-16115: Fixed an uninitialized memory error in GfxUnivariateShading::setupCache. (bsc#1150039)
- Record
SUSE-SU-2023:3399-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
poppleropenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 0.62.0-150000.4.18.1 | 0.62.0-150000.4.18.1 |
popplerSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 0.79.0-150200.3.14.1 | 0.79.0-150200.3.14.1 |
popplerSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 0.79.0-150200.3.14.1 | 0.79.0-150200.3.14.1 |
popplerSUSE:Manager Proxy 4.2 |
before 0.79.0-150200.3.14.1 | 0.79.0-150200.3.14.1 |
popplerSUSE:Manager Server 4.2 |
before 0.79.0-150200.3.14.1 | 0.79.0-150200.3.14.1 |
poppleropenSUSE:Leap 15.4 |
before 0.79.0-150200.3.14.1 | 0.79.0-150200.3.14.1 |
popplerSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 0.24.4-14.29.1 | 0.24.4-14.29.1 |
popplerSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 0.43.0-16.28.1 | 0.43.0-16.28.1 |
poppler-qtSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 0.43.0-16.28.1 | 0.43.0-16.28.1 |
popplerSUSE:Linux Enterprise Server 12 SP5 |
before 0.43.0-16.28.1 | 0.43.0-16.28.1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
poppler-qtSUSE:Linux Enterprise Server 12 SP5 |
before 0.43.0-16.28.1 | 0.43.0-16.28.1 |
popplerSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 0.43.0-16.28.1 | 0.43.0-16.28.1 |
poppler-qtSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 0.43.0-16.28.1 | 0.43.0-16.28.1 |
ipeUbuntu:16.04:LTS |
All versions, plus listed versions 7.1.4-2.17.1.8-17.1.10-17.1.10-1.1 |
None known |
ipeUbuntu:18.04:LTS |
All versions, plus listed versions 7.2.7-27.2.7-3 |
None known |
ipeUbuntu:20.04:LTS |
All versions, plus listed versions 7.2.9-17.2.13-27.2.13-2build1 |
None known |
ipeUbuntu:22.04:LTS |
All versions, plus listed versions 7.2.23+dfsg1-27.2.24+dfsg1-17.2.24+dfsg1-1build1 |
None known |
ipeUbuntu:24.04:LTS |
All versions, plus listed versions 7.2.27+dfsg1-27.2.28-27.2.28-2.1build27.2.28-2.1build37.2.28-2.1build4 |
None known |
ipeUbuntu:25.10 |
All versions, plus listed versions 7.2.30-1build1 |
None known |
ipeUbuntu:26.10 |
All versions, plus listed versions 7.2.30-1build27.2.30-2 |
None known |
ipeUbuntu:26.04:LTS |
All versions, plus listed versions 7.2.30-1build17.2.30-1build2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-16115 is a high vulnerability (CVSS 7.8) in Glyphandcog Xpdfreader, published September 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in poppler 0.79.0-150200.3.14.1.
References
forum.xpdfreader.com/viewtopic.php?f=3&t=41872
nvd.nist.gov/vuln/detail/CVE-2019-16115
github.com/advisories/GHSA-fx8g-cgwg-pm6c
suse.com/support/update/announcement/2023/suse-su-20233241-1
bugzilla.suse.com/1124150
Show 7 moreShow less
ubuntu.com/security/CVE-2019-16115
cve.org/CVERecord?id=CVE-2019-16115