CVE-2026-116671: Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder

Q: What input would an attacker need to trigger the issue?

The attacker would need to supply a JPEG 2000 image with an invalid progression order field that is processed by the affected Xpdf decoder. The available information does not state how that image must be delivered or whether user interaction is required.

Q: What is the practical impact of successful exploitation?

Processing the malformed JPEG 2000 image can cause Xpdf to enter an infinite loop. This can prevent the affected process from completing normally and may result in a denial of service.

Q: Which versions should be treated as affected?

Xpdf 4.06 and earlier are identified as affected. The provided information does not identify a fixed version.

Published Oct 26, 2026

Updated

Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.

Affected Software

1 affected component

xpdf Xpdf<=4.06

Event History

Oct 26, 2026

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

DescriptionWeakness

Frequently Asked Questions

What input would an attacker need to trigger the issue?

The attacker would need to supply a JPEG 2000 image with an invalid progression order field that is processed by the affected Xpdf decoder. The available information does not state how that image must be delivered or whether user interaction is required.

What is the practical impact of successful exploitation?

Processing the malformed JPEG 2000 image can cause Xpdf to enter an infinite loop. This can prevent the affected process from completing normally and may result in a denial of service.

Which versions should be treated as affected?

Xpdf 4.06 and earlier are identified as affected. The provided information does not identify a fixed version.

CVE-2026-116671: Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder

Affected Software

Event History

Frequently Asked Questions

What input would an attacker need to trigger the issue?

What is the practical impact of successful exploitation?

Which versions should be treated as affected?

Company

Resources

Contact

Frequently Asked Questions

What input would an attacker need to trigger the issue?

What is the practical impact of successful exploitation?

Which versions should be treated as affected?