CVE-2026-12600: CWE-400 Uncontrolled Resource Consumption in Poppler Innodata Labs

This vulnerability involves the JPX decoding implementation in the Poppler fork by Innodata Labs. Specifically, the JPXStream::readCodestream() function uses values from the SIZ segment, such as img.nComps, to allocate memory for tiles and components without proper validation. This lack of validation allows a remote attacker to trigger uncontrolled memory allocation by processing a specially crafted PDF containing JPXDecode images, resulting in resource exhaustion and denial of service by causing the pdftoppm process to terminate due to out-of-memory errors.

A remote attacker can cause a denial-of-service condition by forcing the vulnerable application to consume excessive memory, leading to process termination. This impacts availability of the pdftoppm process when handling malicious PDF files with crafted JPXDecode images.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time.