CVE-2022-27135: xpdfreader xpdf Out-of-bounds Write
Vulnerability summary
CVE-2022-27135 is a medium (CVSS 5.5) Out-of-bounds Write vulnerability in xpdfreader xpdf. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 25-04-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
xpdf 4.03 has heap buffer overflow in the function readXRefTable located in XRef.cc. An attacker can exploit this bug to cause a Denial of Service (Segmentation fault) or other unspecified effects by sending a crafted PDF file to the pdftoppm binary.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.03%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
+0.01 pp
From 1.02% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundPoc
Maturity: poc
Exploit Reference (forum.xpdfreader.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Ubuntu1 product
- ipeAll versions (No fix recorded)
Xpdfreader1 product
- xpdf4.03
2 vendors · 2 products