Innodata Labs
Monthly
Uncontrolled memory consumption in the JPXStream::readCodestream() function of Innodata Labs' Poppler fork allows remote, unauthenticated attackers to crash the pdftoppm process by supplying a maliciously crafted PDF containing JPXDecode image streams. The SIZ marker segment in a JPEG 2000 codestream provides attacker-controlled values - such as img.nComps - that are used directly in tile and component memory allocation without bounds validation, triggering out-of-memory conditions. No active exploitation has been confirmed (not in CISA KEV), no public proof-of-concept has been identified, and a vendor patch is available per INCIBE advisory.
Uncontrolled memory consumption in the JPXStream::readCodestream() function of Innodata Labs' Poppler fork allows remote, unauthenticated attackers to crash the pdftoppm process by supplying a maliciously crafted PDF containing JPXDecode image streams. The SIZ marker segment in a JPEG 2000 codestream provides attacker-controlled values - such as img.nComps - that are used directly in tile and component memory allocation without bounds validation, triggering out-of-memory conditions. No active exploitation has been confirmed (not in CISA KEV), no public proof-of-concept has been identified, and a vendor patch is available per INCIBE advisory.