CVE-2024-4141: 
NixOS vulnerability analysis and mitigation

Out-of-bounds array write vulnerability in Xpdf 4.05 and earlier, identified as CVE-2024-4141, was discovered in April 2024. The vulnerability is triggered by an invalid character code in a Type 1 font, where the root cause was identified as a bounds check being optimized away by modern compilers (NVD, CVE).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) with varying CVSS v3.1 scores. The National Vulnerability Database (NVD) assigns it a medium severity score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the original assigning CNA (Glyph & Cog, LLC) rates it as low severity with a score of 2.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) (NVD).

The vulnerability primarily affects the availability of the system, with no direct impact on confidentiality or integrity. The high availability impact rating from NVD suggests potential system crashes or service disruptions when exploited (NVD).

The vulnerability requires local access to the system with low attack complexity according to NVD's assessment. Low privileges are required to exploit the vulnerability, and no user interaction is necessary (NVD).

The vulnerability affects Xpdf version 4.05 and earlier versions. Some distributions, such as Debian, are not affected as they use poppler, which is a fork of Xpdf that diverged long ago (Debian).