CVE-2026-116671
Description
A flaw was found in Xpdf. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a specially crafted JPEG 2000 image. Due to improper validation of the progression order field, processing the file triggers an infinite loop that causes the application to hang.
Statement
This vulnerability is classified as Moderate rather than Important because exploitation requires user interaction to process an untrusted document and only results in a local application hang without memory corruption or unauthorized data access. The flaw affects the parsing of embedded JPEG 2000 graphics within the PDF viewer, resulting in an unterminating loop that consumes CPU resources until the process is terminated. In Red Hat ecosystems, Xpdf is not part of the default core operating system installation and is distributed solely through Extra Packages for Enterprise Linux (EPEL) and Fedora repositories.
Mitigation
The fix arrives in Xpdf 4.07 (upstream advisory: https://www.xpdfreader.com/security-bug/CVE-2026-116671.html). No backport mitigation is required for community streams beyond updating to the fixed package once available.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
