CVE-2026-12600
Received Received - Intake

Memory Exhaustion in Poppler JPX Decoding

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Denial-of-service (DoS) vulnerability in the internal JPEG2000 (JPX) decoding implementation of the Poppler fork developed by Innodata Labs. When an application processes an untrusted PDF file containing specially crafted JPXDecode images, a remote attacker can cause uncontrolled memory consumption. The flaw occurs in the JPXStream::readCodestream() function, where values controlled from the SIZ segment (such as img.nComps) are used for the memory allocation of tiles and components without adequate validation. This allows an attacker to force excessive memory allocation and cause a resource exhaustion, ultimately causing the pdftoppm process to terminate due to out-of-memory (OOM) conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-12600
EUVD
EUVD-2026-65467

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
innodata_labs poppler *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-12600 is a denial-of-service (DoS) vulnerability in the internal JPEG2000 (JPX) decoding implementation of the Poppler fork developed by Innodata Labs. When an application processes a PDF file containing specially crafted JPXDecode images, a remote attacker can cause uncontrolled memory consumption by exploiting a flaw in the JPXStream::readCodestream() function. The issue arises when values from the SIZ segment, such as img.nComps, are used for memory allocation without proper validation, leading to excessive memory usage and process termination due to out-of-memory conditions.

Detection Guidance

Monitor for processes like pdftoppm consuming excessive memory when processing PDFs with JPX images. Check system logs for OOM terminations. Use tools like ps, top, or htop to observe memory usage spikes during PDF processing.

Impact Analysis

This vulnerability can impact you by causing applications that use the vulnerable Poppler fork to crash or become unresponsive when processing malicious PDF files. This may lead to denial of service, disrupting services that rely on PDF processing. If exploited in a server environment, it could affect multiple users or systems simultaneously.

Mitigation Strategies

Avoid processing untrusted PDFs with JPX images. Disable or remove the vulnerable JPX decoder if possible. Monitor for DoS attempts and restrict access to PDF processing tools. Consider using the original Poppler project's version without the JPX decoder.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart