CVE-2009-4117

MuPDF < 20091125231942 - 'pdf_shade4.c' Multiple Stack Buffer Overflows

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-4117 has a selected CVSS score of 9.3; EIP currently links 1 catalogued exploit.

Description

Multiple stack-based buffer overflows in pdf_shade4.c in MuPDF before commit 20091125231942, as used in SumatraPDF before 1.0.1, allow remote attackers to cause a denial of service and possibly execute arbitrary code via a /Decode array for certain types of shading that are not properly handled by the (1) pdf_loadtype4shade, (2) pdf_loadtype5shade, (3) pdf_loadtype6shade, and (4) pdf_loadtype7shade functions. NOTE: some of these details are obtained from third party information.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBMuPDF < 20091125231942 - 'pdf_shade4.c' Multiple Stack Buffer OverflowsExploitDB exploitby Christophe DevineWriteup1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing multiple stack-based buffer overflows in MuPDF's pdf_shade4.c. It includes a timeline, vulnerable code snippet, exploitation notes, and a Ruby script that creates a PDF with an oversized /Decode array to trigger a crash. The script is explicitly labeled 'crash only' and the author states that modification for successful exploitation is left as an exercise.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a vulnerability disclosure and proof-of-concept (PoC) script for CVE-2009-4117, a stack buffer overflow in MuPDF/SumatraPDF. It describes the vulnerability, provides a Ruby script to generate a malicious PDF that triggers a crash, and discusses exploitation techniques. No backdoor, trojan, or deceptive payload targeting the person running the PoC is present. The script's purpose is to create a PDF that exploits the target application, which is normal exploit behavior.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
Languagesrubyenglish
Target softwareMuPDFSumatraPDF
Attack typesstack-based buffer overflow
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is primarily a technical analysis and description of the vulnerability, including a timeline, code snippet, and exploitation theory. The included Ruby script is explicitly described as 'crash only' PoC code and does not contain shellcode or exploit payload; the author states that modification for successful exploitation is left as an exercise. Therefore, the artifact is a writeup, not an exploit or scanner.

exploits/windows/local/10244.txt:64exploits/windows/local/10244.txt:86-87

Requirements

  • Target must be running a vulnerable version of MuPDF or SumatraPDF (before commit 20091125231942 or version 1.0.1 respectively).exploits/windows/local/10244.txt:5-8
  • The Origami PDF framework Ruby library must be available to run the provided script.exploits/windows/local/10244.txt:60-61

Observed behavior

  • The Ruby script generates a PDF file named 'toto.pdf' containing a shading object with an oversized /Decode array designed to overflow stack buffers c0 and c1 in the vulnerable functions.exploits/windows/local/10244.txt:64-83
  • The generated PDF is intended to cause a crash (denial of service) when opened with a vulnerable version of SumatraPDF.exploits/windows/local/10244.txt:64
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
Payload withheldThe text describes CVE-2009-4117 and provides a PoC script to trigger the vulnerability.exploits/windows/local/10244.txt:5-7
Poc Script
Payload withheldThe script generates a PDF file (toto.pdf) that triggers the buffer overflow when opened in a vulnerable version of SumatraPDF.exploits/windows/local/10244.txt:64-83
Exploitation Notes
Payload withheldThe author provides guidance on how to modify the PoC for code execution, which is typical for exploit documentation.exploits/windows/local/10244.txt:40-58
Review boundaries

What the analysis did not establish

  • The artifact references an external Metasploit-generated shellcode and a jmp esp gadget in a specific SumatraPDF binary, but these are not included in the evidence.
  • The Ruby script requires the external Origami PDF framework library, which is not provided.
  • The review is limited to the supplied text file; no external resources, binaries, or the generated PDF were inspected.
  • The PoC script is not executed, so its runtime behavior is not verified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

10