Executive brief
Xpdf is a PDF viewer widely used in Linux and embedded systems. A crafted PDF file containing a Type 3 font with a glyph of zero height can trigger a divide-by-zero error, causing the application to crash and denying users access to PDF documents.
Technical details
The vulnerability is a divide-by-zero condition in Xpdf's Type 3 font glyph rendering logic. When processing a glyph with zero height, the code attempts a division operation without validating the height value, resulting in a runtime exception. The attack requires the victim to open a maliciously crafted PDF file. This is a local denial-of-service issue with no privilege escalation or data exposure risk. Patches are available in versions after 4.06.
Affected products
- Xpdf Xpdf 4.06 and earlier
Timeline
- 2026-09-03: disclosed