Live › vulnerability › CVE-2026-116671
Go to dashboardXpdf 4.06 and earlier loop forever when parsing a JPEG 2000 image with a bad progression order field. An attacker who gets a user to open a crafted PDF can freeze the viewer or a service that renders PDFs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Teams that run Xpdf 4.06 or earlier to view or convert PDFs, especially servers that process user-uploaded PDFs with embedded JPEG 2000 images. Systems that do not ship or run Xpdf, or that use a different PDF renderer, are not affected.
No product ranges from the sources yet.
xpdf -v or check the installed Xpdf version and compare it with 4.06xpdf package is listed in the advisory as affected: unknown4.06: unknown (the sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.
This page as .md · .json · in your agent: get_signal("CVE-2026-116671")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.