TI-2022-08125 Aliases CVE-2022-24198 GHSA-8c9h-4q7g-fp7h

iText v7.1.17 was discovered to contain an out-of-bounds exception via the component…

LOW 30CWE-125Published 2022-02-01 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-125 and the CVSS impact.

Summary

iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. NOTE: Vendor does not view this as a vulnerability and has not found it to be exploitable.

Why it matters now

EPSS 0.00547 46th percentileScored 2026-11-07

Fix Fixed com.itextpdf:itext7-core (Maven): 7.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	com.itextpdf:itext7-core (Maven)	before 7.2.0	7.2.0	Patch available	GHSA-8c9h-4q7g-fp7h

— Vendor— Affected all versions Fixed in — No fix listed CNA
com.itextpdf:itext7-core (Maven) Vendor— Affected before 7.2.0 Fixed in 7.2.0 Patch available GHSA-8c9h-4q7g-fp7h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:itextpdf:itext:7.1.17:::::::*	7.1.17	Vulnerable	Itextpdf

cpe:2.3:a:itextpdf:itext:7.1.17:*:*:*:*:*:*:* Versions 7.1.17 Vulnerable ·Itextpdf

Remediation

Fix · GHSA-8c9h-4q7g-fp7h com.itextpdf:itext7-core (Maven) Fixed in 7.2.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-24198
2026-10-03 Alias added: GHSA-8c9h-4q7g-fp7h

References

Advisory 3

Other 1

https://github.com/itext/itext7

TI-2021-19160 iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a… CVSS 3.1CRITICAL 9.8
TI-2017-06550 The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external… CVSS 3.0HIGH 8.8
TI-2022-08123 iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an… CVSS 3.1MEDIUM 6.5
TI-2023-05782 Apryse iText Reference Table PdfDocument.java memory leak CVSS 3.1MEDIUM 6.5
TI-2023-05781 Apryse iText PdfDocument.java main array index CVSS 3.1MEDIUM 6.5
TI-2022-08124 iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences