CVE-2022-38171

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).

• CWE-190

• http://www.openwall.com/lists/oss-security/2022/09/02/11Mailing List, Third Party Advisory
• http://www.xpdfreader.com/security-fixes.htmlVendor Advisory
• https://dl.xpdfreader.com/xpdf-4.04.tar.gzVendor Advisory
• https://github.com/jeffssh/CVE-2021-30860Third Party Advisory
• https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.mdPatch, Third Party Advisory
• https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.htmlThird Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2021-30860Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/09/02/11Mailing List, Third Party Advisory
• http://www.xpdfreader.com/security-fixes.htmlVendor Advisory
• https://dl.xpdfreader.com/xpdf-4.04.tar.gzVendor Advisory
• https://github.com/jeffssh/CVE-2021-30860Third Party Advisory
• https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.mdPatch, Third Party Advisory
• https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.htmlThird Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2021-30860Third Party Advisory

Published

Aug 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38165Arbitrary file write in F-Secure Policy Manager through 2022…9.8
• CVE-2022-38166In F-Secure Endpoint Protection for Windows and macOS before…7.5
• CVE-2022-38167The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XS…6.1
• CVE-2022-38168Broken Access Control in User Authentication in Avaya Scopia…9.1
• CVE-2022-3817A vulnerability has been found in Axiomatic Bento4 and class…6.5
• CVE-2022-38170In Apache Airflow prior to 2.3.4, an insecure umask was conf…4.7
• CVE-2022-38172ServiceNow through San Diego Patch 3 allows XSS via the name…6.1
• CVE-2022-38176An issue was discovered in YSoft SAFEQ 6 before 6.0.72. Inco…7.8
• CVE-2022-38177By spoofing the target resolver with responses that have a m…7.5
• CVE-2022-38178By spoofing the target resolver with responses that have a m…7.5
• CVE-2022-38179JetBrains Ktor before 2.1.0 was vulnerable to the Reflect Fi…6.1
• CVE-2022-3818An uncontrolled resource consumption issue when parsing URLs…5.3