EUVD-2026-70735
GHSA-8rpr-r8gp-748h
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file open required (UI:R), high complexity to craft the malformed Type 3 font, and zero confidentiality or integrity impact - only a low-severity crash.
Primary rating from Vendor (GandC).
CVSS VectorVendor: GandC
Lifecycle Timeline
2DescriptionCVE.org
Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.
AnalysisAI
Divide-by-zero crash in Xpdf 4.06 and earlier is triggered when the PDF rendering engine encounters a Type 3 font glyph whose declared height is zero, causing an abnormal application termination. The CVSS 4.0 score of 2.1, with all confidentiality and integrity metrics at N and only VA:L, confirms this is a pure availability impact - no memory disclosure or code execution is achievable through this path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim to open a locally supplied or socially-engineered PDF document containing a Type 3 font definition in which at least one glyph declares a zero height, using Xpdf 4.06 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is very low across all available signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed Xpdf release indicated on the vendor security advisory at https://www.xpdfreader.com/security-bug/CVE-2026-85458.html; no specific patched version number was present in the available input data and could not be independently confirmed, so the advisory page should be checked directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. Rated high severity (CVS
XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393. Rated high severity (CVSS 7.8), this vulnerab
XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::lookChar() at /xpdf/Stream.cc. Rated
XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readScan() at /xpdf/Stream.cc. Rated
XPDF commit ffaf11c was discovered to contain a global-buffer overflow via Lexer::getObj(Object*) at /xpdf/Lexer.cc. Rat
XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::getChar() at /xpdf/Stream.cc. Rated
XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable*) at /xpdf/
XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc
XPDF commit ffaf11c was discovered to contain a stack overflow via __asan_memcpy at asan_interceptors_memintrinsics.cpp.
XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files. Rated
There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mis
There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. Rated high severity (CVSS 7
Same weakness CWE-369 – Divide By Zero
View allShare
External POC / Exploit Code
Leaving vuln.today