Security readout for executives and security teams
Plain-English summary
This issue affects Xpdf 4.01.01 PDF handling. A specially crafted PDF can trigger a memory safety bug when processed by pdftoppm. The public record does not provide a CVSS score, confirmed business impact, or a named vendor fix.
Executive priority
Treat this as a targeted remediation item for systems that process external PDFs. Urgency rises if Xpdf 4.01.01 is used in automated intake, document conversion, or customer-upload workflows.
Technical view
CVE-2019-13289 is a use-after-free in JBIG2Stream::close() in JBIG2Stream.cc. The CVE description says it can be triggered with a crafted PDF sent to pdftoppm. No CWE, CVSS vector, or complete affected-product metadata is provided.
Likely exposure
Exposure is most likely where Xpdf 4.01.01 or pdftoppm processes untrusted PDF files, including automated conversion pipelines. Bundled or downstream use is possible but not confirmed by the provided sources.
Exploitation context
The CVE is not marked as KEV. The source bundle includes a public proof-of-concept repository reference, but no cited evidence of active exploitation or real-world campaigns.
Researcher notes
Evidence is limited to the CVE description and a public PoC reference. The record names Xpdf 4.01.01 and pdftoppm but lacks CVSS, CWE, patch details, and broader affected-product metadata.
Mitigation direction
- Inventory systems using Xpdf 4.01.01 or pdftoppm.
- Check Xpdf or distribution vendor guidance for fixed versions.
- Avoid processing untrusted PDFs with affected tooling until remediated.
- Run PDF conversion in a sandboxed, least-privilege environment.
- Restrict automated PDF intake from untrusted sources where feasible.
Validation and detection
- Confirm installed Xpdf and pdftoppm versions across servers and build images.
- Review PDF-processing services for use of Xpdf 4.01.01.
- Check package manager or vendor advisories for available updates.
- Verify sandboxing and privilege boundaries around PDF conversion jobs.
- Search logs for crashes in pdftoppm or Xpdf PDF processing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-13289 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/PanguL4b/pocs/tree/master/xpdf/heap-use-after-free_JBIG2StreamCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.