CVE-2026-116671 Xpdf CVE debrief

Who should care

Defenders responsible for Xpdf deployments should assess exposure and prioritize verification of Xpdf versions. This vulnerability could lead to denial-of-service attacks if exploited, and defenders should review and update incident response plans to address potential impacts. Defenders should also implement additional monitoring for potential denial-of-service attacks.

Why it matters

CVE-2026-116671 is a low-severity vulnerability in Xpdf that could lead to denial-of-service attacks if exploited. Defenders responsible for Xpdf deployments should assess exposure and prioritize verification of Xpdf versions.

• Potential denial-of-service attacks
• Need for verification of Xpdf versions and exposure
• Possible impact on incident response plans

Technical summary

The vulnerability is caused by incorrect validation of the progression order field in JPEG 2000 images, leading to an infinite loop in Xpdf 4.06 and earlier. This could lead to denial-of-service attacks if exploited. The vulnerability has a low CVSS score of 2.1 and is considered a low-severity vulnerability. Defenders should prioritize verifying Xpdf versions and assessing exposure.

Defensive priority

Defenders should prioritize verifying Xpdf versions and assessing exposure, as this vulnerability could lead to denial-of-service attacks.

Recommended defensive actions

• Verify Xpdf versions in use and assess exposure
• Implement additional monitoring for potential denial-of-service attacks
• Review and update incident response plans to address potential impacts

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on exploitation and impact is limited. There is no evidence of exploitation in the wild. Defenders should verify Xpdf versions and assess exposure. The source item provides details on the vulnerability, but the impact is not well understood.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.