CVE-2025-11896
LowCVSS 2.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In Xpdf 4.05 (and earlier), a PDF object loop in a CMap, via the "UseCMap" entry, leads to infinite recursion and a stack overflow. This may cause an application crash when processing a malicious PDF file.
Risk Assessment
An attacker could deliver a specially crafted PDF file that causes an application crash (denial of service) during processing.
Recommendation
Update Xpdf to a version later than 4.05 if available, or avoid processing untrusted PDF files until a fix is released.
Other vulnerabilities in Xpdf
See all- CVE-2022-24106Low
In Xpdf prior to 4.04, the DCT (JPEG) decoder incorrectly allowed the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc. The flaw may be triggered when processing crafted PDF files.
- CVE-2026-85458Low
Xpdf 4.06 and earlier versions contain a divide-by-zero vulnerability when a glyph in a Type 3 font has a zero height. This can lead to program crashes or unexpected behavior.
- CVE-2023-3436Low
Xpdf version 4.04 can deadlock when processing a PDF object stream whose 'Length' field is in another object stream.
- CVE-2023-3044Low
Xpdf has a vulnerability related to excessively large PDF page sizes, which can lead to a divide-by-zero error in the text extraction code. This issue was discovered during fuzz testing and is unlikely to occur in normal PDF files.
Original NVD description (English source)
In Xpdf 4.05 (and earlier), a PDF object loop in a CMap, via the "UseCMap" entry, leads to infinite recursion and a stack overflow.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS