CVE-2026-4407: Xpdf

Low severity, CVSS 2.1. EPSS: 0.1% chance of exploitation in the next 30 days.

Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces.

Affected products

• Xpdf Xpdf: version 4.06 only

Published 2026-03-18. Last modified 2026-06-17.