Low severity · published Oct 26, 2026
CVE-2026-116671
Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder
New
2.1
CVSS
0.1%
EPSS
No
On KEV
Description
Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XP
Xpdf · Xpdf
through 4.06 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116671
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116671
www.xpdfreader.com
https://www.xpdfreader.com/security-bug/CVE-2026-116671.html
More from Xpdf
2.1
CVE-2026-85458
Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph
–
CVE-2009-4035
The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value…
–
CVE-2007-4352
Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows…
–
CVE-2007-5393
Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains…
–
CVE-2007-5392
Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a…