CVE-2021-31811
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file
MEDIUM
5.5
CVSS Score
Published: June 12, 2021 at 09:45 AM UTC
Updated: June 17, 2026 at 03:52 AM UTC
12 products affected across 3 vendorsFedoraOutside In TechnologyPrimavera Unifier
Using Apache PDFBox by Apache Software Foundation?
Get instant alerts when new vulnerabilities affect Apache PDFBox - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 4%
Description
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
2.0.0 ≤ v ≤ 2.0.23Apache PDFBox ≤ v < 2.0.24
Affected range stops below 2.0.24, so it looks safe — our inference, not a vendor statement
14.0.0 ≤ v ≤ 14.3.014.5
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e%40%3Cusers.pdfbox.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
References (17)
Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
http://www.openwall.com/lists/oss-security/2021/06/12/2Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea%40%3Ccommits.ofbiz.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f%40%3Ccommits.ofbiz.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba%40%3Ccommits.ofbiz.apache.org%3Ex_refsource_MISCMailing Listx_refsource_MLISTVendor Advisory
Source: [email protected]
https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e%40%3Cusers.pdfbox.apache.org%3ECVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-789CWE-770
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card