CVE-2026-4407CWE-20CWE-787

Out-of-bounds array write in Xpdf 4.06 due to missing validation

Low · published March 18, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
3.8
In the wild
Unconfirmed
What it is

Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00150 · 3.8th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-787 · Out-of-bounds Write
Published
2026-03-18T21:44Z
EPSS history
Timeline
  • 18 MAR 21:44Z
    Out-of-bounds array write in Xpdf 4.06 due to missing validation
    cvelistv5