What’s Vulnerable › Vulnerabilities
CVE-2026-12600: Uncontrolled memory usage in Innodata Labs’ Poppler JPX decoder
- Severity: high (CVSS 8.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-25 · updated 2026-09-28
- Weakness: CWE-400
Description
Denial-of-service (DoS) vulnerability in the internal JPEG2000 (JPX) decoding implementation of the Poppler fork developed by Innodata Labs. When an application processes an untrusted PDF file containing specially crafted JPXDecode images, a remote attacker can cause uncontrolled memory consumption. The flaw occurs in the JPXStream::readCodestream() function, where values controlled from the SIZ segment (such as img.nComps) are used for the memory allocation of tiles and components without adequate validation. This allows an attacker to force excessive memory allocation and cause a resource exhaustion, ultimately causing the pdftoppm process to terminate due to out-of-memory (OOM) conditions.
Affected products
- Poppler Innodata Labs: before 25/08/2026 — fixed in 25/08/2026
How to fix
Upgrade to a fixed version: Poppler Innodata Labs 25/08/2026. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-12600 or the next vulnerability affects your stack