Executive brief
The Innodata Labs fork of Poppler, a widely-used PDF processing library, contains a memory exhaustion flaw in its JPEG2000 image decoder. When processing a malicious PDF containing specially crafted JPXDecode images, the decoder can be forced to allocate excessive amounts of memory, crashing the PDF processing tool and disrupting document processing workflows.
Technical details
A denial-of-service vulnerability exists in the JPXStream::readCodestream() function within the JPX (JPEG2000) decoder of the Innodata Labs Poppler fork. The vulnerable code fails to validate size values (such as img.nComps) extracted from the SIZ segment of JPXDecode images before using them in memory allocation calculations for tiles and components. This allows an attacker to craft a malicious PDF with unvalidated image parameters that trigger uncontrolled memory allocation. When an application processes such a PDF, the decoder will exhaust available system memory, causing the PDF processing process to terminate via out-of-memory (OOM) conditions. No patch information is currently available.
Affected products
- Innodata Labs Poppler <unknown>
Timeline
- 2026-08-25: disclosed