CVE-2023-3044

Divide-by-zero in Xpdf 4.04 due to very large page size

3.3 LowFix available

An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code.

This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large character coordinate.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.34%Up 0.3 points since Jun 3, 2023

What each source reports

CVE List Score used 3.3

Divide-by-zero in Xpdf 4.04 due to very large page size

An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code.

This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large character coordinate.

Record: CVE-2023-3044
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-369
Updated: 2026-11-02

EUVDEUVD-2023-43736 3.3

An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code.

This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large character coordinate.

Record: EUVD-2023-43736
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6w33-g59h-852h 3.3

An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can...

An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code.

This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large character coordinate.

Record: GHSA-6w33-g59h-852h
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-369
Updated: 2026-11-02

NVD 3.3

An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code.

This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large character coordinate.

Record: CVE-2023-3044
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-369
Updated: 2026-11-02

OSVALPINE-CVE-2023-3044 3.3

An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code.

This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large character coordinate.

Record: ALPINE-CVE-2023-3044
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated: 2026-11-03

OSVUBUNTU-CVE-2023-3044 3.3

An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code. This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large character coordinate.

Record: UBUNTU-CVE-2023-3044
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVMGASA-2024-0035 No score

Updated xpdf packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Logic bug in text extractor led to invalid memory access. (CVE-2022-30524) Integer overflow in rasterizer. (CVE-2022-30775) PDF object loop in Catalog::countPageTree. (CVE-2022-33108) PDF object loop in AcroForm::scanField. (CVE-2022-36561) Logic bug in JBIG2 decoder. (CVE-2022-38222) PDF object loop in Catalog::countPageTree. (CVE-2022-38334) Missing bounds check in CFF font converter caused null pointer dereference. (CVE-2022-38928) PDF object loop in Catalog::countPageTree. (CVE-2022-41842) Missing bounds check in CFF font parser caused invalid memory access. (CVE-2022-41843) PDF object loop in AcroForm::scanField. (CVE-2022-41844) PDF object loop in Catalog::readPageLabelTree2. (CVE-2022-43071) PDF object loop in Catalog::countPageTree. (CVE-2022-43295) PDF object loop in Catalog::countPageTree. (CVE-2022-45586) PDF object loop in Catalog::countPageTree. (CVE-2022-45587) Divide-by-zero in Xpdf 4.04 due to bad color space object. (CVE-2023-2662) PDF object loop in Catalog::readPageLabelTree2. (CVE-2023-2663) PDF object loop in Catalog::readEmbeddedFileTree. (CVE-2023-2664) Divide-by-zero in Xpdf 4.04 due to very large page size. (CVE-2023-3044) Deadlock in Xpdf 4.04 due to PDF object stream references. (CVE-2023-3436)

Record: MGASA-2024-0035
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`xpdf` Alpine:v3.19	before 4.05-r0	4.05-r0
`xpdf` Alpine:v3.20	before 4.05-r0	4.05-r0
`xpdf` Alpine:v3.21	before 4.05-r0	4.05-r0
`xpdf` Alpine:v3.22	before 4.05-r0	4.05-r0
`xpdf` Alpine:v3.23	before 4.05-r0	4.05-r0
`xpdf` Alpine:v3.24	before 4.05-r0	4.05-r0
`xpdf` Mageia:9 From an advisory covering 19 CVEs	before 4.05-1.mga9	4.05-1.mga9
`ipe` Ubuntu:16.04:LTS	All versions, plus listed versions 7.1.4-2.17.1.8-17.1.10-17.1.10-1.1	None known
`xpdf` Ubuntu:16.04:LTS	All versions, plus listed versions 3.03-17ubuntu23.03-17ubuntu33.03-17ubuntu53.03-183.04-13.04-1build13.04-1ubuntu13.04-1ubuntu1.1	None known
`ipe` Ubuntu:18.04:LTS	All versions, plus listed versions 7.2.7-27.2.7-3	None known

Show 12 moreShow less

Affected packages
Package	Affected	Fixed
`xpdf` Ubuntu:18.04:LTS	All versions, plus listed versions 3.04-4build13.04-53.04-5ubuntu23.04-6ubuntu13.04-7	None known
`ipe` Ubuntu:20.04:LTS	All versions, plus listed versions 7.2.9-17.2.13-27.2.13-2build1	None known
`ipe` Ubuntu:22.04:LTS	All versions, plus listed versions 7.2.23+dfsg1-27.2.24+dfsg1-17.2.24+dfsg1-1build1	None known
`xpdf` Ubuntu:22.04:LTS	All versions, plus listed versions 3.04+git20210103-3build13.04+git20211021-13.04+git20211021-1ubuntu13.04+git20220201-1	None known
`ipe` Ubuntu:24.04:LTS	All versions, plus listed versions 7.2.27+dfsg1-27.2.28-27.2.28-2.1build27.2.28-2.1build37.2.28-2.1build4	None known
`xpdf` Ubuntu:24.04:LTS	All versions, plus listed versions 3.04+git20220601-1ubuntu13.04+git20220601-1ubuntu23.04+git20231213-13.04+git20240118-13.04+git20240124-1 Show 4 moreShow less 3.04+git20240202-13.04+git20240202-1build13.04+git20240202-1build23.04+git20240202-1build3	None known
`ipe` Ubuntu:25.10	All versions, plus listed versions 7.2.30-1build1	None known
`xpdf` Ubuntu:25.10	All versions, plus listed versions 3.04+git20250304-1	None known
`ipe` Ubuntu:26.10	All versions, plus listed versions 7.2.30-1build27.2.30-2	None known
`xpdf` Ubuntu:26.10	All versions, plus listed versions 3.04+git20260220-13.04+git20260220-1ubuntu13.04+git20260802-1	None known
`ipe` Ubuntu:26.04:LTS	All versions, plus listed versions 7.2.30-1build17.2.30-1build2	None known
`xpdf` Ubuntu:26.04:LTS	All versions, plus listed versions 3.04+git20250304-13.04+git20250304-1build13.04+git20260220-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-3044 is a low vulnerability (CVSS 3.3) in Xpdf, published June 2, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in xpdf 4.05-r0.

References

Show 4 moreShow less