CVE-2022-24198

Name of the Vulnerable Software and Affected Versions iText version 7.1.17

Description The issue allows attackers to cause a Denial of Service (DoS) via a crafted PDF file, exploiting an out-of-bounds exception in the ARCFOUREncryption.encryptARCFOUR component. The vendor does not view this as a vulnerability and has not found it to be exploitable.

Recommendations For version 7.1.17, consider disabling the ARCFOUREncryption.encryptARCFOUR component as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.