What is CVE-2004-1125?

CVE-2004-1125 is a vulnerability in Easy Software Products Cups, classified under Improper Input Validation. Published 2005-01-10.

Is CVE-2004-1125 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Easy Software Products Cups

CVE-2004-1125

Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PDF file that causes the boundaries of a maskColors array to be exceeded.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2005-01-10 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.066 (93.6th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 93.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.066 · newest: 0.066 · change: 0.000

Affected products

Easy Software Products Cups — versions 1.1.20
KDE — versions 3.2.3, 3.3.2
Xpdf — versions 3.0

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

References

www.redhat.com/support/errata/RHSA-2005-013.html (vendor-advisory)
secunia.com/advisories/17277 (third-party-advisory)
www.redhat.com/support/errata/RHSA-2005-066.html (vendor-advisory)
www.redhat.com/support/errata/RHSA-2005-034.html (vendor-advisory)
www.redhat.com/support/errata/RHSA-2005-018.html (vendor-advisory)
bugzilla.fedora.us/show_bug.cgi (vendor-advisory)
bugzilla.fedora.us/show_bug.cgi (vendor-advisory)
securitytracker.com/id (vdb-entry)
www.securityfocus.com/bid/12070 (Patch, vdb-entry, Vendor Advisory)
www.kde.org/info/security/advisory-20041223-1.txt

Frequently asked questions

What is CVE-2004-1125?: CVE-2004-1125 is a vulnerability in Easy Software Products Cups, classified under Improper Input Validation. Published 2005-01-10.
Is CVE-2004-1125 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.