Security readout for executives and security teams
Plain-English summary
This CVE describes a null pointer dereference in XPDF 4.04. In practical terms, a crafted PDF could cause vulnerable PDF processing to fail or crash when a user or local workflow opens it. The source bundle rates it high, but affected-product metadata is incomplete beyond XPDF 4.04.
Executive priority
Treat this as a high-priority exposure where XPDF 4.04 processes untrusted PDFs, especially in document intake or analyst workflows. Business urgency is lower where XPDF is absent, unused, or limited to trusted files.
Technical view
CVE-2022-38928 is reported in XPDF 4.04 at FoFiType1C.cc:2393 and maps to CWE-476. The provided CVSS 3.1 vector is 7.8 high with local attack vector and required user interaction. The bundle does not provide patch details, proof-of-concept status, or broader affected CPEs.
Likely exposure
Exposure is most likely where XPDF 4.04 or embedded copies process PDFs on workstations or local document workflows. Prioritize systems handling untrusted PDFs. The source bundle’s affected-product metadata is incomplete, so confirm exposure through inventory rather than assuming all PDF tooling is affected.
Exploitation context
The CVSS vector indicates local access and user interaction are required. The CVE is not listed as KEV, and the supplied sources do not state active exploitation. The bundle does not include exploit mechanics, so treat exploitation evidence as unconfirmed.
Researcher notes
The public bundle is sparse: it names XPDF 4.04, CWE-476, and a source location, but lacks CPEs, fix status, or exploitation evidence. Validate affected builds and downstream packaging before broad remediation claims.
Mitigation direction
- Check XPDF vendor guidance for fixed versions or recommended workarounds.
- Identify and prioritize XPDF 4.04 instances handling untrusted PDFs.
- Restrict vulnerable PDF processing to trusted files until remediation is confirmed.
- Isolate automated PDF processing from sensitive networks and credentials.
- Monitor package maintainers for backported fixes if XPDF is distro-supplied.
Validation and detection
- Search asset inventories and SBOMs for XPDF 4.04.
- Check application bundles for embedded or statically linked XPDF components.
- Confirm whether identified systems process untrusted PDFs.
- Review crash telemetry for XPDF failures during PDF parsing.
- Track remediation against vendor or package-maintainer guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-38928 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://forum.xpdfreader.com/viewtopic.php?f=3&t=42325&sid=7b08ba9a518a99ce3c5ff40e53fc6421CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.