CVE-2024-42358

PDFio is a simple C library for reading and writing PDF files. There is a denial of service (DOS) vulnerability in the TTF parser. Maliciously crafted TTF files can cause the program to utilize 100% of the Memory and enter an infinite loop. This can also lead to a heap-buffer-overflow vulnerability. An infinite loop occurs in the read_camp function by nGroups value. The ttf.h library is vulnerable. A value called nGroups is extracted from the file, and by changing that value, you can cause the program to utilize 100% of the Memory and enter an infinite loop. If the value of nGroups in the file is small, an infinite loop will not occur. This library, whether used as a standalone binary or as part of another application, is vulnerable to DOS attacks when parsing certain types of files. Automated systems, including web servers that use this code to convert PDF submissions into plaintext, can be DOSed if an attacker uploads a malicious TTF file. This issue has been addressed in release version 1.3.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-835
• CWE-835

• https://github.com/michaelrsweet/pdfio/commit/e4e1c39578279386b0ab9f9ac14b20a8bad4f935Patch
• https://github.com/michaelrsweet/pdfio/security/advisories/GHSA-4hh9-j68x-8353Exploit, Vendor Advisory

Published

Aug 6, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42352Nuxt is a free and open-source framework to create full-stac…7.5
• CVE-2024-42353WebOb provides objects for HTTP requests and responses. When…6.1
• CVE-2024-42354Shopware is an open commerce platform. The store-API works w…5.9
• CVE-2024-42355Shopware, an open ecommerce platform, has a new Twig Tag `sw…9.8
• CVE-2024-42356Shopware is an open commerce platform. Prior to versions 6.6…7.2
• CVE-2024-42357Shopware is an open commerce platform. Prior to versions 6.6…9.8
• CVE-2024-4236A vulnerability, which was classified as critical, has been …8.8
• CVE-2024-42360SequenceServer lets you rapidly set up a BLAST+ server with …9.8
• CVE-2024-42361Hertzbeat is an open source, real-time monitoring system. He…9.8
• CVE-2024-42362Hertzbeat is an open source, real-time monitoring system. He…8.8
• CVE-2024-42363Prior to 3385, the user-controlled role parameter enters the…8.8
• CVE-2024-42364Homepage is a highly customizable homepage with Docker and s…6.5