What is the CVSS score of CVE-2026-4407?

CVE-2026-4407 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Which versions of Xpdf are affected by CVE-2026-4407?

CVE-2026-4407 is a low-severity vulnerability involving input validation (CVSS 2.1).

How to fix or mitigate CVE-2026-4407?

During next maintenance window: Apply vendor patches when convenient. Verify input validation controls are in place.

Xpdf CVE-2026-4407

EUVD-2026-12995 LOW

Improper Input Validation (CWE-20)

2026-03-18 GandC

Buffer Overflow Denial Of Service Xpdf

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 22:00 euvd

EUVD-2026-12995

Analysis Generated

Mar 18, 2026 - 22:00 vuln.today

CVE Published

Mar 18, 2026 - 21:44 nvd

LOW 2.1

DescriptionCVE.org

Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces.

AnalysisAI

An out-of-bounds array write vulnerability exists in Xpdf versions 4.06 and earlier, stemming from improper validation of the 'N' field in ICCBased color spaces within PDF documents. This buffer overflow vulnerability affects all versions of Xpdf up to and including 4.06, potentially allowing attackers to achieve arbitrary code execution or denial of service by crafting malicious PDF files with specially crafted color space definitions. No CVSS score or EPSS data is currently available, and active exploitation status is not confirmed in public sources.

Technical ContextAI

Xpdf is a lightweight, open-source PDF reader library widely used for PDF parsing and rendering across multiple platforms. The vulnerability resides in the ICC (International Color Consortium) color space handling code, specifically in how the application validates and processes the 'N' parameter that defines the number of color components in an ICCBased color space. The root cause is classified under CWE-20 (Improper Input Validation), where the application fails to properly validate the 'N' field before using it as an array index or size parameter, leading to a classic buffer overflow condition. This affects all versions of Xpdf covered by CPE cpe:2.3:a:xpdf:xpdf:*:*:*:*:*:*:*:* up to version 4.06.

RemediationAI

Upgrade Xpdf to a patched version released after 4.06, as indicated by the vendor security advisory at https://www.xpdfreader.com/security-bug/CVE-2026-4407.html. Pending patch availability, implement compensating controls by restricting Xpdf usage to trusted PDF sources only, disabling automatic PDF processing in email and web clients, running Xpdf in sandboxed or containerized environments to limit blast radius, and monitoring for suspicious PDF file delivery patterns. Organizations should prioritize patching once the vendor releases a fixed version, as buffer overflows in PDF libraries pose significant risk when processing untrusted documents.