CVE-2024-22641

tcpdf - security update

7.5 HighPublic exploitFix available

TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.11%Up 1.1 points since Feb 14, 2025

What each source reports

CVE List Score used 7.5

TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.

Record: CVE-2024-22641
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-434
Updated: 2026-11-02

EUVDEUVD-2024-20174 7.5

TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.

Record: EUVD-2024-20174
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

NVD 7.5

TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.

Record: CVE-2024-22641
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-434
Updated: 2026-11-02

OSV 7.5

TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.

Record: CVE-2024-22641
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-22641 7.5

TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.

Record: DEBIAN-CVE-2024-22641
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-22641 7.5

TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.

Record: UBUNTU-CVE-2024-22641
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2024-0361 No score

Updated php-tcpdf packages fix security vulnerability

TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file. (CVE-2024-22641)

Record: MGASA-2024-0361
Updated: 2026-11-02

Affected products

tcpdf project tcpdf

Affected packages

Affected packages
Package	Affected	Fixed
`tcpdf` Debian:12	before 6.6.2+dfsg1-1+deb12u1, plus listed versions 6.6.2+dfsg1-1	6.6.2+dfsg1-1+deb12u1
`tcpdf` Debian:13	before 6.7.7+dfsg-1	6.7.7+dfsg-1
`tcpdf` Debian:14	before 6.7.7+dfsg-1	6.7.7+dfsg-1
`tcpdf` Debian:11	before 6.3.5+dfsg1-1+deb11u1, plus listed versions 6.3.5+dfsg1-1	6.3.5+dfsg1-1+deb11u1
`php-tcpdf` Mageia:9	before 6.5.0-1.2.mga9	6.5.0-1.2.mga9
`tcpdf` Ubuntu:14.04:LTS	All versions, plus listed versions 6.0.010+dfsg-16.0.021+dfsg-16.0.048+dfsg-16.0.048+dfsg-2	None known
`tcpdf` Ubuntu:16.04:LTS	All versions, plus listed versions 6.0.093+dfsg-16.0.093+dfsg-1ubuntu1	None known
`tcpdf` Ubuntu:18.04:LTS	All versions, plus listed versions 6.2.12+dfsg2-1ubuntu16.2.13+dfsg-16.2.13+dfsg-1ubuntu1	None known
`tcpdf` Ubuntu:20.04:LTS	All versions, plus listed versions 6.2.13+dfsg-1ubuntu16.3.2+dfsg1-16.3.4+dfsg1-16.3.5+dfsg1-1	None known
`tcpdf` Ubuntu:22.04:LTS	All versions, plus listed versions 6.3.5+dfsg1-16.4.2+dfsg1-16.4.4+dfsg1-1	None known

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`tcpdf` Ubuntu:24.04:LTS	All versions, plus listed versions 6.6.2+dfsg1-16.6.5+dfsg-16.7.4+dfsg-16.7.5+dfsg-1	None known
`tcpdf` Ubuntu:25.10	All versions, plus listed versions 6.8.2+dfsg-16.9.1+dfsg-1	None known
`tcpdf` Ubuntu:26.10	All versions, plus listed versions 6.11.2+dfsg-2	None known
`tcpdf` Ubuntu:26.04:LTS	All versions, plus listed versions 6.9.1+dfsg-16.10.1+dfsg-16.10.1+dfsg-26.10.1+dfsg-2ubuntu16.10.1+dfsg-2ubuntu26.11.2+dfsg-2	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	zunak/CVE-2024-22641	2024-04-01

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-22641 is a high vulnerability (CVSS 7.5) in Tcpdf Project Tcpdf, published May 28, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in tcpdf 6.6.2+dfsg1-1+deb12u1.

References

Show 5 moreShow less