High severity7.8NVD Advisory· Published Aug 27, 2017· Updated May 13, 2026
CVE-2017-12595
CVE-2017-12595
Description
The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.
Affected products
2cpe:2.3:a:qpdf_project:qpdf:6.0.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:qpdf_project:qpdf:6.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:qpdf_project:qpdf:7.0.b1:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/qpdf/qpdf/commit/ad527a64f93dca12f6aabab2ca99ae5eb352ab4bnvdIssue TrackingPatchThird Party Advisory
- github.com/qpdf/qpdf/issues/146nvdIssue TrackingPatchThird Party Advisory
- usn.ubuntu.com/3638-1/nvd
News mentions
0No linked articles in our index yet.