Xpdf as used in products such as gpdf kpdf pdftohtml poppler teTeX CUPS libextractor and others allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.