Description
iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. NOTE: Vendor does not view this as a vulnerability and has not found it to be exploitable.
References (2)
Core 2
Core References
Third Party Advisory
https://github.com/itext/itext7/pull/78
Third Party Advisory
https://github.com/itext/itext7/pull/78#issuecomment-1089287808
Scores
CVSS v3
6.5
EPSS
0.0028
EPSS Percentile
51.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Details
CWE
CWE-125
Status
published
Products (2)
com.itextpdf/itext7-core
0 - 7.2.0Maven
itextpdf/itext
7.1.17
Published
Feb 01, 2022
Tracked Since
Feb 18, 2026