CVE-2026-4407 LOW

CVE-2026-4407: Out-of-bounds array write in Xpdf 4.06 due to missing validation

Vendor Xpdf

Product Xpdf

Weakness CWE-20 · Input validation

Published March 18, 2026

Last update March 19, 2026

CVSS base score

2.1/10

Attack vector Local

Attack complexity High

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces.

Key dates

March 18, 2026 CVE published

March 19, 2026 Record updated

External resources

Related vulnerabilities