CVE-2026-116671

Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder

State: Published
Severity: 2.1 Low
Published: Oct 26, 2026
Updated: Oct 26, 2026
Reserved: Oct 26, 2026

Description

Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.

Scores

CVSS	Score	Vector	Source
4.0	2.1 Low	CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	GandC

Weaknesses

CWE-20 Improper input validation
CWE-835 Loop with unreachable exit condition ('infinite loop')

Affected Products

Product	Versions
XpdfXpdf	4.06 and earlierAffected

References

https://www.xpdfreader.com/security-bug/CVE-2026-116671.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.