Every CVE Search/ Get API key

CVE-2022-24106

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to...

7.8 HighFix available

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.31%Down 0.6 points since Aug 30, 2022
90%50%10%1%

What each source reports

NVD Score used 7.8

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.

Record
CVE-2022-24106
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
CVE List No score

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.

Record
CVE-2022-24106
Updated
2026-11-02
EUVDEUVD-2022-29018 No score

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.

Record
EUVD-2022-29018
Updated
2026-11-03
GitHub AdvisoriesGHSA-35x2-6j99-3gv6 7.8

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to...

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.

Record
GHSA-35x2-6j99-3gv6
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2022-24106 7.8

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.

Record
ALPINE-CVE-2022-24106
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 7.8

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.

Record
CVE-2022-24106
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2022-24106 7.8

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.

Record
UBUNTU-CVE-2022-24106
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2022-24106 No score

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.

Record
DEBIAN-CVE-2022-24106
Updated
2026-11-03
OSVMGASA-2022-0320 No score

Updated xpdf packages fix security vulnerability

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc. (CVE-2022-24106)

Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc. (CVE-2022-24107)

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. (CVE-2022-38171)

Record
MGASA-2022-0320
Updated
2026-11-02
OSVUSN-7985-1 No score

texlive-bin vulnerabilities

Shin Ando discovered that the Xpdf toolkit embedded in TeX Live incorrectly handled memory when decoding certain data streams. An attacker could possibly use this issue to cause TeX Live to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24106, CVE-2022-24107)

It was discovered that TeX Live allowed documents to make arbitrary network requests. If a user or automated system were tricked into opening a specially crafted document, a remote attacker could possibly use this issue to exfiltrate sensitive information, or perform other network-related attacks. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-32668)

It was discovered that TeX Live incorrectly handled certain TrueType fonts. If a user or automated system were tricked into opening a specially crafted TrueType font, a remote attacker could use this issue to cause TeX Live to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-25262)

Record
USN-7985-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xpdf
Alpine:v3.19
 before 4.04-r0
4.04-r0
xpdf
Alpine:v3.20
 before 4.04-r0
4.04-r0
xpdf
Alpine:v3.21
 before 4.04-r0
4.04-r0
xpdf
Alpine:v3.22
 before 4.04-r0
4.04-r0
xpdf
Alpine:v3.23
 before 4.04-r0
4.04-r0
xpdf
Alpine:v3.24
 before 4.04-r0
4.04-r0
poppler
Debian:12
 All versions, plus listed versions
22.12.0-222.12.0-2+deb12u122.12.0-2+deb12u222.12.0-2+deb12u322.12.0-2.1
Show 41 moreShow less
22.12.0-2.223.08.0-123.08.0-223.12.0-124.02.0-124.02.0-224.02.0-324.02.0-424.02.0-524.02.0-5+loong6424.06.0-124.06.0-224.08.0-124.08.0-224.08.0-324.08.0-425.01.0-125.01.0-225.01.0-325.01.0-425.01.0-525.03.0-125.03.0-1025.03.0-1125.03.0-11.125.03.0-225.03.0-325.03.0-425.03.0-525.03.0-625.03.0-725.03.0-926.01.0-126.01.0-226.01.0-326.01.0-426.01.0-4.126.01.0-526.07.0-126.07.0-226.07.0-3
 None known
poppler
Debian:13
 All versions, plus listed versions
25.03.0-1025.03.0-1125.03.0-11.125.03.0-525.03.0-5+deb13u2
Show 14 moreShow less
25.03.0-5+deb13u325.03.0-5+deb13u425.03.0-625.03.0-725.03.0-926.01.0-126.01.0-226.01.0-326.01.0-426.01.0-4.126.01.0-526.07.0-126.07.0-226.07.0-3
 None known
poppler
Debian:14
 All versions, plus listed versions
25.03.0-1025.03.0-1125.03.0-11.125.03.0-525.03.0-6
Show 11 moreShow less
25.03.0-725.03.0-926.01.0-126.01.0-226.01.0-326.01.0-426.01.0-4.126.01.0-526.07.0-126.07.0-226.07.0-3
 None known
xpdf
Mageia:8
From an advisory covering 3 CVEs
 before 4.04-1.mga8
4.04-1.mga8
Show 20 moreShow less
Affected packages
PackageAffectedFixed
emscripten
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.22.1-1build1
 None known
ipe
Ubuntu:16.04:LTS
 All versions, plus listed versions
7.1.4-2.17.1.8-17.1.10-17.1.10-1.1
 None known
xpdf
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.03-17ubuntu23.03-17ubuntu33.03-17ubuntu53.03-183.04-13.04-1build13.04-1ubuntu13.04-1ubuntu1.1
 None known
emscripten
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.22.1-1build1
 None known
ipe
Ubuntu:18.04:LTS
 All versions, plus listed versions
7.2.7-27.2.7-3
 None known
texlive-bin
Ubuntu:Pro:20.04:LTS
 before 2019.20190605.51237-3ubuntu0.2+esm1, plus listed versions
2019.20190605.51237-2build12019.20190605.51237-32019.20190605.51237-3build12019.20190605.51237-3build22019.20190605.51237-3ubuntu0.12019.20190605.51237-3ubuntu0.2
2019.20190605.51237-3ubuntu0.2+esm1
ipe
Ubuntu:20.04:LTS
 All versions, plus listed versions
7.2.9-17.2.13-27.2.13-2build1
 None known
emscripten
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.0.13~dfsg-13.1.1~dfsg+~1.39.6-5ubuntu43.1.2~dfsg+~1.39.6-6ubuntu13.1.3~dfsg-4ubuntu13.1.3~dfsg-5ubuntu13.1.4~dfsg-7ubuntu13.1.5~dfsg-3ubuntu1
 None known
ipe
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.2.23+dfsg1-27.2.24+dfsg1-17.2.24+dfsg1-1build1
 None known
texlive-bin
Ubuntu:22.04:LTS
 before 2021.20210626.59705-1ubuntu0.3, plus listed versions
2020.20200327.54578-72020.20200327.54578-7build12021.20210626.59705-12021.20210626.59705-1build12021.20210626.59705-1ubuntu0.12021.20210626.59705-1ubuntu0.2
2021.20210626.59705-1ubuntu0.3
emscripten
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.1.6~dfsg-53.1.6~dfsg-63.1.6~dfsg-7
 None known
ipe
Ubuntu:24.04:LTS
 All versions, plus listed versions
7.2.27+dfsg1-27.2.28-27.2.28-2.1build27.2.28-2.1build37.2.28-2.1build4
 None known
emscripten
Ubuntu:25.10
 All versions, plus listed versions
3.1.69+dfsg-13.1.69+dfsg-3
 None known
ipe
Ubuntu:25.10
 All versions, plus listed versions
7.2.30-1build1
 None known
emscripten
Ubuntu:26.10
 All versions, plus listed versions
3.1.69+dfsg-46.0.5+dfsg+~1.41.5-2
 None known
ipe
Ubuntu:26.10
 All versions, plus listed versions
7.2.30-1build27.2.30-2
 None known
emscripten
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.69+dfsg-33.1.69+dfsg-4
 None known
ipe
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.2.30-1build17.2.30-1build2
 None known
texlive-bin
Ubuntu:Pro:16.04:LTS
 before 2015.20160222.37495-1ubuntu0.1+esm1, plus listed versions
2015.20150524.37493-5build12015.20150524.37493-72015.20150524.37493-7build12015.20150524.37493-7build42015.20160222.37495-12015.20160222.37495-1ubuntu0.1
2015.20160222.37495-1ubuntu0.1+esm1
texlive-bin
Ubuntu:Pro:18.04:LTS
 before 2017.20170613.44572-8ubuntu0.2+esm1, plus listed versions
2017.20170613.44572-5build12017.20170613.44572-5build22017.20170613.44572-62017.20170613.44572-6build12017.20170613.44572-6ubuntu12017.20170613.44572-8build12017.20170613.44572-8ubuntu0.12017.20170613.44572-8ubuntu0.2
2017.20170613.44572-8ubuntu0.2+esm1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-24106 is a high vulnerability (CVSS 7.8) in Glyphandcog Xpdfreader, published August 30, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in xpdf 4.04-r0.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open