CVE-2019-9878

There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf 4.0.0, as used in pdfalto 0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.

• CWE-125

• https://github.com/kermitt2/pdfalto/issues/46Third Party Advisory
• https://research.loginsoft.com/bugs/invalid-memory-access-in-gfxindexedcolorspacemapcolortobase-pdfalto-0-2/Exploit, Third Party Advisory
• https://github.com/kermitt2/pdfalto/issues/46Third Party Advisory
• https://research.loginsoft.com/bugs/invalid-memory-access-in-gfxindexedcolorspacemapcolortobase-pdfalto-0-2/Exploit, Third Party Advisory

Published

Mar 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9871Jector Smart TV FM-K75 devices allow remote code execution b…
• CVE-2019-9872In several versions of JetBrains IntelliJ IDEA Ultimate, cre…
• CVE-2019-9873In several versions of JetBrains IntelliJ IDEA Ultimate, cre…
• CVE-2019-9874Deserialization of Untrusted Data in the Sitecore.Security.A…9.8
• CVE-2019-9875Deserialization of Untrusted Data in the anti CSRF module in…8.8
• CVE-2019-9877There is an invalid memory access vulnerability in the funct…
• CVE-2019-9879The WPGraphQL 0.2.3 plugin for WordPress allows remote attac…
• CVE-2019-9880An issue was discovered in the WPGraphQL 0.2.3 plugin for Wo…
• CVE-2019-9881The createComment mutation in the WPGraphQL 0.2.3 plugin for…
• CVE-2019-9882Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF…
• CVE-2019-9883Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF…
• CVE-2019-9884eClass platform < ip.2.5.10.2.1 allows an attacker to use GE…9.8