PatchTheCVECVE-2005-3626: Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allow
45
This month
MEDIUM 5.0DOWNGRADEDOWNGRADEDOWNGRADE
CVE-2005-3626 is a medium-severity flaw (CVSS 5.0) affecting cups, kdegraphics, koffice. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.
Why this priority
- Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 5.0 (Medium) |
| EPSS exploit chance | 3.4% (top 11%) |
| CISA exploited list | No |
| Weakness | CWE-399 |
| Published | 2005-12-31 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
easy software products cups DOWNGRADE
Affected: 1.1.22 · 1.1.22_rc1 · 1.1.23 · 1.1.23_rc1
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.1.22
1. Check installed version
apt-cache policy cups || rpm -q cups || cups --version
2. No fixed release: DOWNGRADE to a release before 1.1.22 (Debian / Ubuntu)
apt-cache madison cups
sudo apt install cups=<VERSION_BEFORE_1.1.22>
sudo apt-mark hold cups
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list cups
sudo dnf downgrade cups-<VERSION_BEFORE_1.1.22>
sudo dnf versionlock add cups
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
kde kdegraphics DOWNGRADE
Affected: 3.2 · 3.4.3
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.2
1. Check installed version
apt-cache policy kdegraphics || rpm -q kdegraphics || kdegraphics --version
2. No fixed release: DOWNGRADE to a release before 3.2 (Debian / Ubuntu)
apt-cache madison kdegraphics
sudo apt install kdegraphics=<VERSION_BEFORE_3.2>
sudo apt-mark hold kdegraphics
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list kdegraphics
sudo dnf downgrade kdegraphics-<VERSION_BEFORE_3.2>
sudo dnf versionlock add kdegraphics
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
kde koffice DOWNGRADE
Affected: 1.4 · 1.4.1 · 1.4.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.4
1. Check installed version
apt-cache policy koffice || rpm -q koffice || koffice --version
2. No fixed release: DOWNGRADE to a release before 1.4 (Debian / Ubuntu)
apt-cache madison koffice
sudo apt install koffice=<VERSION_BEFORE_1.4>
sudo apt-mark hold koffice
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list koffice
sudo dnf downgrade koffice-<VERSION_BEFORE_1.4>
sudo dnf versionlock add koffice
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
kde kpdf DOWNGRADE
Affected: 3.2 · 3.4.3
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.2
1. Check installed version
apt-cache policy kpdf || rpm -q kpdf || kpdf --version
2. No fixed release: DOWNGRADE to a release before 3.2 (Debian / Ubuntu)
apt-cache madison kpdf
sudo apt install kpdf=<VERSION_BEFORE_3.2>
sudo apt-mark hold kpdf
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list kpdf
sudo dnf downgrade kpdf-<VERSION_BEFORE_3.2>
sudo dnf versionlock add kpdf
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
kde kword DOWNGRADE
Affected: 1.4.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.4.2
1. Check installed version
apt-cache policy kword || rpm -q kword || kword --version
2. No fixed release: DOWNGRADE to a release before 1.4.2 (Debian / Ubuntu)
apt-cache madison kword
sudo apt install kword=<VERSION_BEFORE_1.4.2>
sudo apt-mark hold kword
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list kword
sudo dnf downgrade kword-<VERSION_BEFORE_1.4.2>
sudo dnf versionlock add kword
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
libextractor libextractor MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy libextractor || rpm -q libextractor || libextractor --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2005-3626?
cups: downgrade or apply the listed mitigation; kdegraphics: downgrade or apply the listed mitigation; koffice: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2005-3626 being exploited?
CVE-2005-3626 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2005-3626 affect?
CVE-2005-3626 affects cups, kdegraphics, koffice. Severity is medium (CVSS 5.0). Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.
How urgent is CVE-2005-3626?
Priority 45/100. Public exploit reference
Related CVEs
- CVE-2026-61702 MEDIUM 5.3 UPGRADE OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems
- CVE-2026-39316 MEDIUM 4.0 UPGRADE OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems
- CVE-2026-41079 MEDIUM 4.3 UPGRADE OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems
- CVE-2026-39314 MEDIUM 4.0 UPGRADE OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems
- CVE-2026-107885 LOW 3.3 UPGRADE OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handli