EUVD-2026-42767
GHSA-v2wp-4h2v-wxcx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Crafted file is remotely deliverable to a decoding service with no privileges (AV:N/PR:N); impact is a decoder crash only, so C:N/I:N and A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
AnalysisAI
Denial of service in Artifex jbig2dec (JBIG2 decoder, commit cc37d0) lets a remote attacker crash the decoder by supplying a crafted JBIG2 image that triggers an integer overflow in jbig2_arith_iaid_ctx_new(). Impact is availability-only (CVSS 7.5, A:H) with no data exposure or code execution indicated. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application actually invokes jbig2dec to decode a JBIG2-encoded image, and that the attacker can supply an untrusted JBIG2 stream (directly or embedded in a PDF/PostScript document) reaching that decoder - the specific trigger is a crafted input whose values cause the size computation in jbig2_arith_iaid_ctx_new() to overflow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 driven entirely by availability impact - there is no confidentiality or integrity effect, so this is a crash/DoS, not RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious PDF or standalone JBIG2 image with header fields tuned to overflow the size calculation in jbig2_arith_iaid_ctx_new(), then delivers it to a service or user whose application uses jbig2dec (e.g., a server-side PDF-to-image conversion pipeline or a desktop viewer). When the file is processed, the decoder crashes, denying service; given AV:N/AC:L, delivery is straightforward and low-complexity, and a researcher gist referenced by NVD may already contain a reproducing sample. |
| Remediation | No vendor-released patched version is identified at time of analysis and the EUVD record does not name a fixed release, so the primary action is to track the upstream jbig2dec repository (https://github.com/ArtifexSoftware/jbig2dec) for a commit that adds overflow validation to jbig2_arith_iaid_ctx_new() past commit cc37d0, then rebuild or update any bundled copies in Ghostscript/MuPDF-based products. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify business applications and systems using jbig2dec; prioritize those handling external image uploads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today