CVE-2022-24196

Vulnerability

iText versions 7.1.17 up to (excluding) 7.1.18 and 7.2.2 contain an out-of-memory error in the readStreamBytesRaw component. An attacker can trigger this by providing a specially crafted PDF file that forces the library to allocate excessive memory during stream processing [1][2].

Exploitation

An attacker does not need any special privileges or authentication; the only requirement is that the targeted application parses a malicious PDF using the vulnerable iText version. The attacker delivers the crafted PDF (e.g., via email, file upload, or network share) and the vulnerable code path is triggered automatically when readStreamBytesRaw processes the malformed stream data [3][4].

Impact

Successful exploitation results in a Denial of Service (DoS) condition: the iText process runs out of memory and crashes, potentially causing the host application to become unresponsive or terminate. No data confidentiality, integrity, or code execution is reported [1].

Mitigation

Upgrade to iText 7.1.18 (if using the 7.1.x line) or 7.2.2 (if using the 7.2.x line), which contain the fix. Users of versions between 7.1.17 and these releases are vulnerable. No workaround is documented; the only mitigation is to apply the available patch [1][2]. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.