CVE-2022-24107
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
- Record
CVE-2022-24107- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
- Record
CVE-2022-24107- Updated
- 2026-11-02
EUVDEUVD-2022-29019 No score
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
- Record
EUVD-2022-29019- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xwhw-9p7r-3vq8
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
- Record
GHSA-xwhw-9p7r-3vq8- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-24107
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
- Record
ALPINE-CVE-2022-24107- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-24107
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
- Record
UBUNTU-CVE-2022-24107- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2022-0320 No score
Updated xpdf packages fix security vulnerability
In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc. (CVE-2022-24106)
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc. (CVE-2022-24107)
Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. (CVE-2022-38171)
- Record
MGASA-2022-0320- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xpdfAlpine:v3.19 |
before 4.04-r0 | 4.04-r0 |
xpdfAlpine:v3.20 |
before 4.04-r0 | 4.04-r0 |
xpdfAlpine:v3.21 |
before 4.04-r0 | 4.04-r0 |
xpdfAlpine:v3.22 |
before 4.04-r0 | 4.04-r0 |
xpdfAlpine:v3.23 |
before 4.04-r0 | 4.04-r0 |
xpdfAlpine:v3.24 |
before 4.04-r0 | 4.04-r0 |
xpdfMageia:8 From an advisory covering 3 CVEs |
before 4.04-1.mga8 | 4.04-1.mga8 |
emscriptenUbuntu:16.04:LTS |
All versions, plus listed versions 1.22.1-1build1 |
None known |
ipeUbuntu:16.04:LTS |
All versions, plus listed versions 7.1.4-2.17.1.8-17.1.10-17.1.10-1.1 |
None known |
xpdfUbuntu:16.04:LTS |
All versions, plus listed versions 3.03-17ubuntu23.03-17ubuntu33.03-17ubuntu53.03-183.04-13.04-1build13.04-1ubuntu13.04-1ubuntu1.1 |
None known |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
emscriptenUbuntu:18.04:LTS |
All versions, plus listed versions 1.22.1-1build1 |
None known |
ipeUbuntu:18.04:LTS |
All versions, plus listed versions 7.2.7-27.2.7-3 |
None known |
texlive-binUbuntu:Pro:20.04:LTS |
before 2019.20190605.51237-3ubuntu0.2+esm1, plus listed versions 2019.20190605.51237-2build12019.20190605.51237-32019.20190605.51237-3build12019.20190605.51237-3build22019.20190605.51237-3ubuntu0.12019.20190605.51237-3ubuntu0.2 |
2019.20190605.51237-3ubuntu0.2+esm1 |
ipeUbuntu:20.04:LTS |
All versions, plus listed versions 7.2.9-17.2.13-27.2.13-2build1 |
None known |
emscriptenUbuntu:22.04:LTS |
All versions, plus listed versions 2.0.13~dfsg-13.1.1~dfsg+~1.39.6-5ubuntu43.1.2~dfsg+~1.39.6-6ubuntu13.1.3~dfsg-4ubuntu13.1.3~dfsg-5ubuntu13.1.4~dfsg-7ubuntu13.1.5~dfsg-3ubuntu1 |
None known |
ipeUbuntu:22.04:LTS |
All versions, plus listed versions 7.2.23+dfsg1-27.2.24+dfsg1-17.2.24+dfsg1-1build1 |
None known |
texlive-binUbuntu:22.04:LTS |
before 2021.20210626.59705-1ubuntu0.3, plus listed versions 2020.20200327.54578-72020.20200327.54578-7build12021.20210626.59705-12021.20210626.59705-1build12021.20210626.59705-1ubuntu0.12021.20210626.59705-1ubuntu0.2 |
2021.20210626.59705-1ubuntu0.3 |
emscriptenUbuntu:24.04:LTS |
All versions, plus listed versions 3.1.6~dfsg-53.1.6~dfsg-63.1.6~dfsg-7 |
None known |
ipeUbuntu:24.04:LTS |
All versions, plus listed versions 7.2.27+dfsg1-27.2.28-27.2.28-2.1build27.2.28-2.1build37.2.28-2.1build4 |
None known |
emscriptenUbuntu:25.10 |
All versions, plus listed versions 3.1.69+dfsg-13.1.69+dfsg-3 |
None known |
ipeUbuntu:25.10 |
All versions, plus listed versions 7.2.30-1build1 |
None known |
emscriptenUbuntu:26.10 |
All versions, plus listed versions 3.1.69+dfsg-46.0.5+dfsg+~1.41.5-2 |
None known |
ipeUbuntu:26.10 |
All versions, plus listed versions 7.2.30-1build27.2.30-2 |
None known |
emscriptenUbuntu:26.04:LTS |
All versions, plus listed versions 3.1.69+dfsg-33.1.69+dfsg-4 |
None known |
ipeUbuntu:26.04:LTS |
All versions, plus listed versions 7.2.30-1build17.2.30-1build2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24107 is a high vulnerability (CVSS 7.8) in Glyphandcog Xpdfreader, published August 30, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in xpdf 4.04-r0.