CVEs-PoC/2018/CVE-2018-9918.md

CVE-2018-9918

Description

libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to cause a denial of service (stack exhaustion), related to the QPDFObjectHandle and QPDF_Dictionary classes, because nesting in direct objects is not restricted.

POC

Reference

• https://github.com/qpdf/qpdf/issues/202
• https://github.com/qpdf/qpdf/issues/202

Github

No PoCs found on GitHub currently.