CVE-2021-36978
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in...
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
- Record
CVE-2021-36978- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
- Record
CVE-2021-36978- Updated
- 2026-11-02
EUVDEUVD-2021-23554 No score
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
- Record
EUVD-2021-23554- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vgrr-57vg-f5rq
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in...
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
- Record
GHSA-vgrr-57vg-f5rq- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
- Record
CVE-2021-36978- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-36978
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
- Record
DEBIAN-CVE-2021-36978- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2021-36978
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
- Record
UBUNTU-CVE-2021-36978- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2022:2669-1 No score
Security update for qpdf
This update for qpdf fixes the following issues:
- CVE-2022-34503: Fixed a heap buffer overflow via the function QPDF::processXRefStream (bsc#1201830).
- CVE-2021-36978: Fixed heap-based buffer overflow in Pl_ASCII85Decoder::write (bsc#1188514).
- Record
SUSE-SU-2022:2669-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:2670-1 No score
Security update for qpdf
This update for qpdf fixes the following issues:
- CVE-2022-34503: Fixed a heap buffer overflow via the function QPDF:processXRefStream (bsc#1201830).
- CVE-2021-36978: Fixed heap-based buffer overflow in Pl_ASCII85Decoder::write (bsc#1188514).
- Record
SUSE-SU-2022:2670-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3248-1 No score
Security update for qpdf
This update for qpdf fixes the following issues:
- CVE-2021-36978: Fixed heap-based buffer overflow in Pl_ASCII85Decoder::write (bsc#1188514).
- Record
SUSE-SU-2022:3248-1- Updated
- 2026-11-02
OSVUSN-5026-1 No score
qpdf vulnerabilities
It was discovered that QPDF incorrectly handled certain malformed PDF files. A remote attacker could use this issue to cause QPDF to consume resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-18020)
It was discovered that QPDF incorrectly handled certain malformed PDF files. A remote attacker could use this issue to cause QPDF to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-36978)
- Record
USN-5026-1- Updated
- 2026-11-02
OSVUSN-5026-2 No score
qpdf vulnerabilities
USN-5026-1 fixed several vulnerabilities in QPDF. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details:
It was discovered that QPDF incorrectly handled certain malformed PDF files. A remote attacker could use this issue to cause QPDF to consume resources, resulting in a denial of service. (CVE-2018-18020)
It was discovered that QPDF incorrectly handled certain malformed PDF files. A remote attacker could use this issue to cause QPDF to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-36978)
- Record
USN-5026-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qpdfDebian:12 |
before 10.1.0-1 | 10.1.0-1 |
qpdfDebian:13 |
before 10.1.0-1 | 10.1.0-1 |
qpdfDebian:14 |
before 10.1.0-1 | 10.1.0-1 |
qpdfDebian:10 From an advisory covering 3 CVEs |
before 8.4.0-2+deb10u1, plus listed versions 8.4.0-2 |
8.4.0-2+deb10u1 |
qpdfSUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs |
before 7.1.1-3.8.1 | 7.1.1-3.8.1 |
qpdfSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs |
before 7.1.1-3.8.1 | 7.1.1-3.8.1 |
qpdfSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 2 CVEs |
before 7.1.1-3.8.1 | 7.1.1-3.8.1 |
qpdfSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 2 CVEs |
before 7.1.1-3.8.1 | 7.1.1-3.8.1 |
qpdfSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 2 CVEs |
before 7.1.1-3.8.1 | 7.1.1-3.8.1 |
qpdfSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 2 CVEs |
before 7.1.1-3.8.1 | 7.1.1-3.8.1 |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qpdfSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 2 CVEs |
before 7.1.1-3.8.1 | 7.1.1-3.8.1 |
qpdfSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 7.1.1-3.8.1 | 7.1.1-3.8.1 |
qpdfSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 7.1.1-3.8.1 | 7.1.1-3.8.1 |
qpdfSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfSUSE:Enterprise Storage 6 From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfopenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 8.0.2-150000.3.5.1 | 8.0.2-150000.3.5.1 |
qpdfSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfSUSE:Linux Enterprise Server 15 SP2-BCL |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfSUSE:Manager Proxy 4.1 |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfSUSE:Manager Retail Branch Server 4.1 |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfSUSE:Manager Server 4.1 |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfSUSE:Enterprise Storage 7 |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfopenSUSE:Leap 15.3 |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfopenSUSE:Leap 15.4 |
before 9.0.2-150200.3.3.1 | 9.0.2-150200.3.3.1 |
qpdfUbuntu:Pro:16.04:LTS |
before 8.0.2-3~16.04.1+esm1, plus listed versions 5.1.3-25.1.3-35.2.0-15.2.0-26.0.0-28.0.2-3~16.04.1 |
8.0.2-3~16.04.1+esm1 |
qpdfUbuntu:18.04:LTS |
before 8.0.2-3ubuntu0.1, plus listed versions 7.0.0-17.1.0-17.1.1-18.0.0-18.0.1-18.0.2-18.0.2-3 |
8.0.2-3ubuntu0.1 |
qpdfUbuntu:20.04:LTS |
before 9.1.1-1ubuntu0.1, plus listed versions 8.4.2-19.0.2-19.1.0-19.1.1-19.1.1-1build1 |
9.1.1-1ubuntu0.1 |
qpdfUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 8.0.2-3ubuntu0.1, plus listed versions 7.0.0-17.1.0-17.1.1-18.0.0-18.0.1-18.0.2-18.0.2-3 |
8.0.2-3ubuntu0.1 |
qpdfUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 9.1.1-1ubuntu0.1, plus listed versions 8.4.2-19.0.2-19.1.0-19.1.1-19.1.1-1build1 |
9.1.1-1ubuntu0.1 |
qpdfUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 8.0.2-3~16.04.1+esm1, plus listed versions 5.1.3-25.1.3-35.2.0-15.2.0-26.0.0-28.0.2-3~16.04.1 |
8.0.2-3~16.04.1+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-36978 is a medium vulnerability (CVSS 5.5) in Qpdf Project Qpdf, published July 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 70th percentile. Fixed in qpdf 10.1.0-1.
References
github.com/qpdf/qpdf/issues/492
bugs.chromium.org/p/oss-fuzz/issues/detail?id=28262
lists.debian.org/debian-lts-announce/2023/08/msg00037.html
security.gentoo.org/glsa/202401-20
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-36978
security-tracker.debian.org/tracker/CVE-2021-36978
suse.com/support/update/announcement/2022/suse-su-20222669-1
bugzilla.suse.com/1188514
ubuntu.com/security/CVE-2021-36978
cve.org/CVERecord?id=CVE-2021-36978