The BufStream::lookChar function in Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file, as demonstrated by pdftohtml.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-8104.json"
[ { "events": [ { "introduced": "0" }, { "last_affected": "4.00" } ] } ]