CVE-2026-4407 PUBLISHED

Out-of-bounds array write in Xpdf 4.06 due to missing validation

Assigner: GandC
Reserved: 18.03.2026 Published: 18.03.2026 Updated: 19.03.2026

Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 2.1

Product Status

Vendor Xpdf
Product Xpdf
Versions Default: unaffected
  • Version 4.06 is affected

Credits

  • wooseokdotkim finder

References

Problem Types

  • CWE-20 Improper input validation CWE
  • CWE-787 Out-of-bounds write CWE