CVE-2017-12595 - CVE House
Back to Database
Status published High CVE-2017-12595

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for...

Vulnerability Description

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-12595

Credits & Attribution

No credits recorded in the NVD database.

References

More from qpdf project

View All →
CVE-2022-34503
QPDF v8.4.2 was discovered to contain a heap buffer overflow...
Medium 6.5
CVE-2021-36978
QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a...
Medium 5.5
CVE-2021-25786
An issue was discovered in QPDF version 10.0.4, allows remote...
Medium 5.3
CVE-2018-9918
libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key...
High 7.8
CVE-2018-18020
In QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive...
Low 3.3

Affected Vendor

qpdf project

View all reports →

Affected Software

qpdf
Vulnerable Versions:
6.0.0, 7.0.b1

Timeline

Official Publish: August 27th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.