https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2009-4035.htmlhttps://patchthecve.com/cve/CVE-2009-4035.htmlTue, 16 Jun 2026 23:12:52 +0000HIGH 9.3: The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a crhttps://patchthecve.com/cve/CVE-2007-5393.htmlhttps://patchthecve.com/cve/CVE-2007-5393.htmlTue, 16 Jun 2026 22:46:01 +0000HIGH 9.3: Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.https://patchthecve.com/cve/CVE-2007-5392.htmlhttps://patchthecve.com/cve/CVE-2007-5392.htmlTue, 16 Jun 2026 22:46:01 +0000HIGH 9.3: Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow.https://patchthecve.com/cve/CVE-2007-4352.htmlhttps://patchthecve.com/cve/CVE-2007-4352.htmlTue, 16 Jun 2026 22:43:52 +0000HIGH 7.6: Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.https://patchthecve.com/cve/CVE-2007-0104.htmlhttps://patchthecve.com/cve/CVE-2007-0104.htmlTue, 16 Jun 2026 22:34:55 +0000MEDIUM 6.8: The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruptihttps://patchthecve.com/cve/CVE-2006-1244.htmlhttps://patchthecve.com/cve/CVE-2006-1244.htmlTue, 16 Jun 2026 22:22:17 +0000HIGH 7.6: Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdfkit.framework, (b) gpdf, (c) pdftohtml, and (d) libextractor, has unknown impact and user-assisted attack vectors, possibly involving errors in (1) gmem.c, (2) SplashXPathScanner.cc, (3) JBhttps://patchthecve.com/cve/CVE-2006-0746.htmlhttps://patchthecve.com/cve/CVE-2006-0746.htmlTue, 16 Jun 2026 22:21:12 +0000HIGH 7.5: Certain patches for kpdf do not include all relevant patches from xpdf that were associated with CVE-2005-3627, which allows context-dependent attackers to exploit vulnerabilities that were present in CVE-2005-3627.https://patchthecve.com/cve/CVE-2006-0301.htmlhttps://patchthecve.com/cve/CVE-2006-0301.htmlTue, 16 Jun 2026 22:20:18 +0000HIGH 7.5: Heap-based buffer overflow in Splash.cc in xpdf, as used in other products such as (1) poppler, (2) kdegraphics, (3) gpdf, (4) pdfkit.framework, and others, allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exhttps://patchthecve.com/cve/CVE-2005-3628.htmlhttps://patchthecve.com/cve/CVE-2005-3628.htmlTue, 16 Jun 2026 22:17:17 +0000HIGH 7.5: Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via unknown attack vectors.https://patchthecve.com/cve/CVE-2005-3627.htmlhttps://patchthecve.com/cve/CVE-2005-3627.htmlTue, 16 Jun 2026 22:17:17 +0000HIGH 7.5: Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselhttps://patchthecve.com/cve/CVE-2005-3192.htmlhttps://patchthecve.com/cve/CVE-2005-3192.htmlTue, 16 Jun 2026 22:16:27 +0000HIGH 7.5: Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComhttps://patchthecve.com/cve/CVE-2005-3191.htmlhttps://patchthecve.com/cve/CVE-2005-3191.htmlTue, 16 Jun 2026 22:16:26 +0000MEDIUM 5.1: Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPShttps://patchthecve.com/cve/CVE-2005-3193.htmlhttps://patchthecve.com/cve/CVE-2005-3193.htmlTue, 16 Jun 2026 22:16:28 +0000MEDIUM 5.1: Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (hhttps://patchthecve.com/cve/CVE-2005-2097.htmlhttps://patchthecve.com/cve/CVE-2005-2097.htmlTue, 16 Jun 2026 22:14:14 +0000LOW 2.1: xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a "broken" loca table, which causes a large temporary file to be created when xpdf attempts to reconstruct the information.https://patchthecve.com/cve/CVE-2005-0064.htmlhttps://patchthecve.com/cve/CVE-2005-0064.htmlTue, 16 Jun 2026 22:10:26 +0000HIGH 7.5: Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.https://patchthecve.com/cve/CVE-2004-1125.htmlhttps://patchthecve.com/cve/CVE-2004-1125.htmlTue, 16 Jun 2026 22:07:04 +0000HIGH 9.3: Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PDFhttps://patchthecve.com/cve/CVE-2003-0434.htmlhttps://patchthecve.com/cve/CVE-2003-0434.htmlTue, 16 Jun 2026 22:02:11 +0000HIGH 7.5: Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters in an embedded hyperlink.https://patchthecve.com/cve/CVE-2002-1384.htmlhttps://patchthecve.com/cve/CVE-2002-1384.htmlTue, 16 Jun 2026 21:59:13 +0000HIGH 7.2: Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements, as demonstrated by cups-pdf.https://patchthecve.com/cve/CVE-2000-0728.htmlhttps://patchthecve.com/cve/CVE-2000-0728.htmlTue, 16 Jun 2026 21:52:21 +0000HIGH 7.2: xpdf PDF viewer client earlier than 0.91 allows local users to overwrite arbitrary files via a symlink attack.https://patchthecve.com/cve/CVE-2000-0727.htmlhttps://patchthecve.com/cve/CVE-2000-0727.htmlTue, 16 Jun 2026 21:52:21 +0000HIGH 7.6: xpdf PDF viewer client earlier than 0.91 does not properly launch a web browser for embedded URL's, which allows an attacker to execute arbitrary commands via a URL that contains shell metacharacters.