What is CVE-2009-0791?

CVE-2009-0791 is a vulnerability in Apple Cups, classified under CWE-189. Published 2009-06-09.

Is CVE-2009-0791 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apple Cups

CVE-2009-0791

Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.

Published 2009-06-09 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.055 (92.6th percentile), scored 2026-10-01.

Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 92.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.055 · newest: 0.055 · change: 0.000

Affected products

Apple Cups — versions 1.1.17, 1.1.22, 1.3.7

Weakness classification (CWE)

CWE-189

Public proof-of-concept exploits

References

securitytracker.com/id (vdb-entry)
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:10534 (signature, vdb-entry)
www.securityfocus.com/bid/35195 (vdb-entry)
secunia.com/advisories/37028 (third-party-advisory)
secunia.com/advisories/35340 (Vendor Advisory, third-party-advisory)
rhn.redhat.com/errata/RHSA-2009-1501.html (vendor-advisory)
secunia.com/advisories/37079 (third-party-advisory)
www.vupen.com/english/advisories/2009/1488 (vdb-entry, Vendor Advisory)
rhn.redhat.com/errata/RHSA-2009-1512.html (vendor-advisory)
secunia.com/advisories/37077 (third-party-advisory)

Frequently asked questions

What is CVE-2009-0791?: CVE-2009-0791 is a vulnerability in Apple Cups, classified under CWE-189. Published 2009-06-09.
Is CVE-2009-0791 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.