Xpdf CVE-2026-116671

Exploitation requires the victim to open an attacker-supplied PDF that embeds a JPEG 2000 (JP2) image with a deliberately malformed progression order field, processed by Xpdf 4.06 or earlier. The practical limiting factors are significant: the attack vector is local/file-based (AV:L), so the attacker must get the malicious file onto the target and have it opened in Xpdf specifically; impact is confined to availability (process hang, no code execution, data disclosure, or integrity loss); and because Xpdf is a client viewer, realistic exploitation depends on user interaction even though the source vector records UI:N. The impact is recoverable by terminating the hung process.

This is a low-severity, availability-only denial-of-service issue and the signals are consistent in pointing to low real-world priority. The supplied CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) yields a base score of 2.1 with no confidentiality or integrity impact and only limited availability impact (a hang from an infinite loop). EPSS is 0.11% (1st percentile), the vuln.today Decision label is 'monitor', there is no CISA KEV listing, and no public exploit is identified in the input - all reinforcing low urgency. One internal tension worth noting: the source vector marks UI:N even though Xpdf is a client-side PDF viewer where a user must open the crafted document, which realistically implies user interaction; it also marks AC:H for what the description frames as a straightforward malformed-field parsing bug. These are severity-metric choices, not mechanism claims, so they do not change the conclusion but should be reconciled with the vendor. Overall this is a genuine but minor hardening issue, not a priority for emergency patching.

An attacker crafts a PDF containing a JPEG 2000 image whose progression order field is malformed, then delivers it to a victim (e.g. by email or download) who opens it in Xpdf 4.06 or earlier. Incorrect validation of that field drives the parser into an infinite loop, hanging the viewer process and denying availability until it is terminated. No public exploit is identified at time of analysis, though a vendor security advisory for the issue exists.