The vulnerability is an integer overflow in the jbig2_arith_iaid_ctx_new() function within the jbig2dec library, identified in Artifex commit cc37d0. This overflow can be exploited by attackers supplying crafted input to cause a Denial of Service (DoS) by crashing or otherwise disrupting the affected software. The vulnerability affects multiple explicitly listed versions of jbig2dec packaged with Ubuntu LTS distributions from 14.04 through 26.04. There is no indication of confidentiality or integrity impact, only availability is affected. No vendor advisory or patch information is provided, and no known exploits have been observed in the wild.

Successful exploitation results in a Denial of Service (DoS) condition due to an integer overflow in the affected function. The impact is limited to availability disruption; there is no evidence of confidentiality or integrity compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Ubuntu security advisories for updates addressing this issue. Until a fix is available, avoid processing untrusted inputs with affected versions of jbig2dec.