Qpdf is a widely embedded PDF manipulation library that, despite its narrow product scope, plays a critical role in PDF parsing and processing pipelines across numerous downstream applications and tools. The vendor's vulnerability profile centers on a single, modestly represented product with a durable signal of memory-safety and control-flow issues: infinite loops, out-of-bounds writes and reads, uncontrolled recursion, and heap-based buffer overflows that reflect the complexity of PDF format parsing and binary data handling. Defenders should inventory products that depend on this library rather than tracking Qpdf alone, since remediation typically requires downstream vendors to rebuild and redistribute; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Qpdf Project over time
Signals from CVEs in this vendor scope (19 CVEs).
19 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-9918HIGH libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to cause a denial of service (stack exhausti | Apr 10, 2018 | 7.8 | 25 | NO | NO |
CVE-2017-12595HIGH The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation faul | Aug 27, 2017 | 7.8 | 24 | NO | NO |
CVE-2022-34503MEDIUM QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows attackers to cause a Denial of Service (DoS) via a | Jul 22, 2022 | 6.5 | 22 | NO | NO |
CVE-2021-36978MEDIUM QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain do | Jul 20, 2021 | 5.5 | 20 | NO | NO |
CVE-2017-11627MEDIUM A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the PointerHolder function | Jul 25, 2017 | 5.5 | 20 | NO | NO |
CVE-2017-11626MEDIUM A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveL | Jul 25, 2017 | 5.5 | 20 | NO | NO |
CVE-2017-11625MEDIUM A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInS | Jul 25, 2017 | 5.5 | 20 | NO | NO |
CVE-2017-9210MEDIUM libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to unparse functions, ak | May 23, 2017 | 5.5 | 20 | NO | NO |
CVE-2017-9209MEDIUM libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to QPDFObjectHandle::par | May 23, 2017 | 5.5 | 20 | NO | NO |
CVE-2017-9208MEDIUM libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to releaseResolved funct | May 23, 2017 | 5.5 | 20 | NO | NO |
Signals from CVEs in this vendor scope (19 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Qpdf Project.
Media articles that mention a CVE ID that affects a product developed by Qpdf Project — matched by CVE ID, not by vendor name.