CVE-2009-3606: Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used...

Security readout for executives and security teams

CVE-2009-3606 is an old PDF-processing flaw. A malicious PDF could trigger memory corruption in Xpdf or Poppler-based viewers and potentially run code under the user opening the file. Business risk is highest where legacy Linux/Unix desktops, document conversion servers, or PDF preview services still use affected packages. Likely exposure is limited to legacy systems running unpatched Xpdf, Poppler 0.x, kdegraphics KPDF, or distribution packages from the 2009 era. Modern supported distributions are likely patched, but embedded appliances and old document-processing pipelines may persist. Prioritize if the organization has legacy Linux desktops, old document services, or appliances processing PDFs. Otherwise, handle through routine legacy vulnerability cleanup. No active exploitation is evidenced in the provided sources. Mitigation focus: Apply vendor security updates for Xpdf, Poppler, kdegraphics, or OS packages.; For Xpdf, verify fixes equivalent to 3.02pl4 are installed.; Retire unsupported systems that cannot receive package updates..

Prepared

Jun 28, 2026, 19:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.