CVE-2023-3436
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Xpdf version 4.04 can deadlock when processing a PDF object stream whose 'Length' field is in another object stream.
Risk Assessment
Deadlocking may lead to service unavailability, impacting the organization's operational continuity.
Recommendation
It is recommended to upgrade to a newer version of Xpdf to avoid deadlock issues.
Other vulnerabilities in Xpdf 4.04
See all- CVE-2026-85458Low
Xpdf 4.06 and earlier versions contain a divide-by-zero vulnerability when a glyph in a Type 3 font has a zero height. This can lead to program crashes or unexpected behavior.
- CVE-2023-3044Low
Xpdf has a vulnerability related to excessively large PDF page sizes, which can lead to a divide-by-zero error in the text extraction code. This issue was discovered during fuzz testing and is unlikely to occur in normal PDF files.
Original NVD description (English source)
Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS