CVE-2024-6239: Freedesktop Poppler DoS Vulnerability

CVE-2024-6239 Overview

CVE-2024-6239 is an input validation flaw [CWE-20] in the Poppler pdfinfo utility maintained by the Freedesktop project. The vulnerability triggers when pdfinfo is invoked with the -dests parameter against a malformed PDF file. An attacker who supplies a crafted PDF can cause the utility to crash, resulting in a denial of service. The issue affects Freedesktop Poppler and shipped versions of Red Hat Enterprise Linux 7, 8, and 9. No confidentiality or integrity impact is reported, but availability is affected on systems that process untrusted PDFs through Poppler-based tooling.

Critical Impact
A remote attacker can crash the pdfinfo utility through a malformed PDF processed with the -dests flag, disrupting document processing pipelines that rely on Poppler.

Affected Products

Freedesktop Poppler
Red Hat Enterprise Linux 7, 8, and 9
Downstream applications embedding Poppler libraries for PDF metadata extraction

Discovery Timeline

2024-06-21 - CVE-2024-6239 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6239

Vulnerability Analysis

The flaw resides in Poppler's pdfinfo command-line utility, which extracts metadata from PDF files. When invoked with the -dests option, pdfinfo parses the named destinations dictionary inside the PDF. Malformed structures in that dictionary are not adequately validated, causing the parser to terminate abnormally. The result is a denial of service against any workflow that runs pdfinfo -dests on attacker-controlled input. Because the input can be delivered over a network (email attachments, upload endpoints, document conversion services), the attack vector is remote even though the utility runs locally.

Root Cause

The root cause is improper input validation [CWE-20] during processing of the named destinations table. pdfinfo assumes structural invariants about the destinations dictionary that a crafted PDF can violate. The parser fails on the unexpected input rather than rejecting the file gracefully. See the Red Hat CVE-2024-6239 Information page and the Red Hat Bug Report #2293594 for upstream discussion of the defective code path.

Attack Vector

An attacker crafts a PDF containing malformed named destinations and delivers it to a target that processes PDFs through pdfinfo -dests. Common exposure points include document management systems, mail gateways, search indexers, and forensic tooling that rely on Poppler for metadata extraction. Successful exploitation crashes the process handling the file. Repeated submission can sustain the outage across batch or queued processing workers.

No verified public proof-of-concept is available. The vulnerability manifests during PDF parsing when the -dests option is used, so refer to the linked vendor advisories for technical specifics rather than synthetic exploit code.

Detection Methods for CVE-2024-6239

Indicators of Compromise

Repeated abnormal termination of pdfinfo processes, especially with non-zero exit codes or SIGSEGV/SIGABRT signals.
Presence of PDF files in ingest queues that consistently trigger crashes when processed with the -dests flag.
Spikes in restart events for document processing workers that wrap Poppler utilities.

Detection Strategies

Monitor process exit codes and core dump generation for pdfinfo and applications linking libpoppler.
Enable audit logging on document ingestion services to correlate crashes with specific input files.
Inventory installed Poppler package versions across Linux hosts and flag versions predating the vendor-patched builds referenced in RHSA-2024:5305 and RHSA-2024:9167.

Monitoring Recommendations

Alert on repeated pdfinfo crashes originating from the same source, tenant, or upload path.
Track EPSS trend data for CVE-2024-6239 and reprioritize patching if scoring rises.
Retain the malformed input files in a quarantine bucket for forensic review and vendor reporting.

How to Mitigate CVE-2024-6239

Immediate Actions Required

Apply the Red Hat updates in RHSA-2024:5305 and RHSA-2024:9167 to affected RHEL systems.
Upgrade Freedesktop Poppler to the fixed upstream release on non-Red Hat distributions.
Audit build pipelines and containers that bundle Poppler and rebuild them against patched packages.

Patch Information

Red Hat has released fixed packages through RHSA-2024:5305 and RHSA-2024:9167. Package tracking and errata metadata are available on the Red Hat CVE-2024-6239 Information page. Upstream fixes are tracked in Red Hat Bug Report #2293594.

Workarounds

Avoid invoking pdfinfo with the -dests parameter on untrusted PDF files until patches are applied.
Sandbox pdfinfo execution using systemd service hardening, seccomp, or containerization so crashes cannot disrupt the parent workflow.
Enforce automatic restart of PDF processing workers so a crash does not create a sustained outage.

bash

# Configuration example: verify installed Poppler version and apply updates on RHEL
rpm -q poppler poppler-utils
sudo dnf update poppler poppler-utils
# Optionally isolate pdfinfo execution
systemd-run --scope --uid=nobody --property=NoNewPrivileges=yes \
  pdfinfo /path/to/untrusted.pdf