CVE-2023-6298
Apryse iText PdfDocument.java main array index
A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manipulation leads to improper validation of array index. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-246124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. A statement published afterwards explains that the exception is not a vulnerability and the identified CWEs might not apply to the software.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
4.3
Apryse iText PdfDocument.java main array index
A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manipulation leads to improper validation of array index. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-246124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. A statement published afterwards explains that the exception is not a vulnerability and the identified CWEs might not apply to the software.
- Record
CVE-2023-6298- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - CVSS 2.0
- 5.0
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-129
- Updated
- 2026-11-02
EUVDEUVD-2023-58540
4.3
A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manipulation leads to improper validation of array index. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-246124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. A statement published afterwards explains that the exception is not a vulnerability and the identified CWEs might not apply to the software.
- Record
EUVD-2023-58540- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3g98-4f8c-vh63
4.3
A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability...
A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manipulation leads to improper validation of array index. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Record
GHSA-3g98-4f8c-vh63- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-129
- Updated
- 2026-11-02
NVD
4.3
A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manipulation leads to improper validation of array index. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-246124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. A statement published afterwards explains that the exception is not a vulnerability and the identified CWEs might not apply to the software.
- Record
CVE-2023-6298- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-129
- Updated
- 2026-11-02
OSV
4.3
Apryse iText PdfDocument.java main array index
A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manipulation leads to improper validation of array index. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-246124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. A statement published afterwards explains that the exception is not a vulnerability and the identified CWEs might not apply to the software.
- Record
CVE-2023-6298- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-129
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-6298
4.3
A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manipulation leads to improper validation of array index. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-246124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. A statement published afterwards explains that the exception is not a vulnerability and the identified CWEs might not apply to the software.
- Record
UBUNTU-CVE-2023-6298- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libitext5-javaUbuntu:16.04:LTS |
All versions, plus listed versions 5.5.6-15.5.6-2 |
None known |
libitext5-javaUbuntu:18.04:LTS |
All versions, plus listed versions 5.5.6-25.5.6-4 |
None known |
libitext5-javaUbuntu:20.04:LTS |
All versions, plus listed versions 5.5.13.1-1build2 |
None known |
libitext5-javaUbuntu:22.04:LTS |
All versions, plus listed versions 5.5.13.2-1 |
None known |
libitext5-javaUbuntu:24.04:LTS |
All versions, plus listed versions 5.5.13.3-25.5.13.3-35.5.13.3-4 |
None known |
libitext5-javaUbuntu:25.10 |
All versions, plus listed versions 5.5.13.3-4 |
None known |
libitext5-javaUbuntu:26.10 |
All versions, plus listed versions 5.5.13.4-2 |
None known |
libitext5-javaUbuntu:26.04:LTS |
All versions, plus listed versions 5.5.13.3-45.5.13.4-15.5.13.4-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-6298 is a medium vulnerability (CVSS 4.3) in Apryse Itext, published November 26, 2023. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile.
References
vuldb.com?id.246124
vuldb.com?ctiid.246124
drive.google.com/drive/folders/1OBAeGH_rNfa1os6g6QlIt4pL-2NKHZm_?usp=sharing
kb.itextpdf.com/itext/statement-regarding-cve-2022-24198-and-2023-6298
nvd.nist.gov/vuln/detail/CVE-2023-6298
github.com/advisories/GHSA-3g98-4f8c-vh63
github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6298.json
ubuntu.com/security/CVE-2023-6298
cve.org/CVERecord?id=CVE-2023-6298