CyberRota Analysis
AI-GeneratedThe vulnerability affects the internal JPEG2000 decoding implementation in the Poppler library, specifically during the processing of untrusted PDF files with specially crafted JPXDecode images. An attacker can exploit this flaw to trigger uncontrolled memory consumption, leading to denial-of-service conditions by exhausting system resources and terminating the pdftoppm process. Organizations utilizing the Poppler library for PDF processing should prioritize patching this vulnerability to mitigate potential service disruptions.
Original NVD Description
Denial-of-service (DoS) vulnerability in the internal JPEG2000 (JPX) decoding implementation of the Poppler fork developed by Innodata Labs. When an application processes an untrusted PDF file containing specially crafted JPXDecode images, a remote attacker can cause uncontrolled memory consumption. The flaw occurs in the JPXStream::readCodestream() function, where values controlled from the SIZ segment (such as img.nComps) are used for the memory allocation of tiles and components without adequate validation. This allows an attacker to force excessive memory allocation and cause a resource exhaustion, ultimately causing the pdftoppm process to terminate due to out-of-memory (OOM) conditions.