CVE-2023-26930: 
NixOS vulnerability analysis and mitigation

Buffer Overflow vulnerability was discovered in XPDF version 4.04 that allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. This vulnerability has been disputed as the vendor states that it's an expected abort on out-of-memory error (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The issue is classified as CWE-120 (Buffer Copy without Checking Size of Input) and affects the PDFDoc malloc functionality in the pdftotext.cc component (NVD).

The primary impact of this vulnerability is a Denial of Service condition when exploited. However, it's worth noting that the vendor has disputed this classification, stating that the behavior is an expected abort on out-of-memory error rather than a security vulnerability (NVD).

Since this is a disputed vulnerability where the vendor states it's expected behavior, no specific patches have been issued. The vendor's position is that the abort on out-of-memory error is a designed functionality rather than a security flaw (NVD).