Cyber Resilience

CVE-2024-22640

HighPublic PoC

Published: 19 April 2024

Published
19 April 2024
Modified
04 November 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0155 81.8th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-22640 is a high-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability in Tcpdf Project Tcpdf. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 18.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

CWE(s)
CWE-1333

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

The ReDoS vulnerability in TCPDF enables denial of service via crafted HTML color parsing, causing excessive CPU consumption and application exhaustion through exploitation.

Affected Assets

tcpdf project
tcpdf
≤ 6.7.4
fedoraproject
fedora
40

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References