An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade qpdf-docUpgrade qpdf-debuginfoUpgrade qpdf-libsUpgrade qpdfUpgrade qpdf-devel | Jan 10, 2024 | Aug 11, 2023 |
| Debian | — | Upgrade qpdf | Aug 31, 2023 | Aug 11, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 11, 2023 |
| Ubuntu | — | Upgrade qpdf (Ubuntu Pro)Upgrade qpdf | Nov 19, 2024 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub