Security readout for executives and security teams
Plain-English summary
This flaw affects Xpdf 4.01.01 when handling a specially crafted PDF, including through the pdftoppm conversion tool. The reported impact is possible information disclosure from reading memory outside intended bounds. Public metadata does not provide a severity score, fixed version, or complete affected-product list.
Executive priority
Prioritize discovery if the organization converts or renders untrusted PDFs. Without a severity score, fix version, or active-exploitation evidence, this is not automatically an emergency, but exposed PDF-processing services deserve timely vendor confirmation and containment.
Technical view
CVE-2019-13287 is an out-of-bounds read in SplashXPath::strokeAdjust() in splash/SplashXPath.cc in Xpdf 4.01.01. The CVE states it can be triggered by a crafted PDF sent to pdftoppm and may allow information disclosure. It is related to CVE-2018-16368.
Likely exposure
Exposure is most likely where Xpdf 4.01.01 or pdftoppm processes untrusted PDFs. Embedded or repackaged Xpdf code may also matter, but the source bundle lists vendor, product, CPEs, and versions as unavailable.
Exploitation context
The CVE is not marked as KEV, and the provided sources do not state active exploitation. A public proof-of-concept reference exists, so defenders should assume vulnerability details are discoverable, but not infer exploitation in the wild.
Researcher notes
The evidence is specific about function, file, version, tool, and possible impact, but incomplete on CVSS, CWE, CPEs, and remediation. Scope should be validated against actual binaries, source packages, and downstream vendor advisories before assigning final risk.
Mitigation direction
- Identify systems using Xpdf 4.01.01 or pdftoppm for PDF rendering or conversion.
- Check Xpdf and distribution maintainer guidance for fixed packages or recommended mitigations.
- Avoid processing untrusted PDFs with affected tooling until vendor guidance is applied.
- Run PDF conversion workloads with least privilege and process isolation.
- Monitor for crashes or abnormal pdftoppm failures after PDF processing.
Validation and detection
- Inventory installed Xpdf versions and bundled pdftoppm binaries across servers and containers.
- Review application flows that accept uploaded, emailed, or third-party PDFs.
- Confirm whether third-party products embed Xpdf 4.01.01 code.
- Check package advisories for remediation status before closing exposure.
- Review logs for unusual failures during PDF conversion workflows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-13287 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/PanguL4b/pocs/tree/master/xpdf/out-of-bounds-read-in-SplashXPath__strokeAdjustCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.