Xpdf CVE-2026-4407

While formal CVSS and EPSS metrics are not publicly available for this CVE, the underlying technical characteristics indicate moderate-to-high real-world risk. The vulnerability is a buffer overflow in input validation (CWE-20), which typically carries high severity due to potential for code execution. The attack vector appears to be network/local (via malicious PDF delivery), likely requiring low complexity to trigger through a crafted PDF file. The fact that no CVSS vector data is provided suggests this may be a recently disclosed or embargoed vulnerability. Without KEV confirmation or public POC availability, exploitation likelihood cannot be definitively assessed, but buffer overflows in PDF processing libraries historically attract security researcher attention and threat actor interest. Organizations using Xpdf should prioritize patching once available, particularly if processing untrusted PDF content.

An attacker crafts a malicious PDF document with an ICCBased color space definition containing an invalid or oversized 'N' field value that exceeds expected bounds. When Xpdf processes this PDF—either through automated document processing, user preview functionality, or embedded PDF rendering in an application—the out-of-bounds array write is triggered, potentially corrupting adjacent memory or enabling code execution. This could occur silently in background PDF processing or when a user simply opens a weaponized PDF attachment received via email or downloaded from a compromised web server.