An integer overflow occurs in the jbig2_arith_iaid_ctx_new() function of the Artifex jbig2dec library when decoding a specially crafted JBIG2 image. The flaw corrupts memory during decoding, causing the decoder to crash or loop indefinitely. No code execution or data leakage can occur; the effect is limited to availability degradation. The flaw is classified as CWE‑190.

The vulnerability is confined to the jbig2dec library at commit cc37d0. Systems that embed this specific version—such as PDF viewers, image editors, or document conversion tools that rely on JBIG2 decoding—could be affected. The CVE only lists the library itself; no particular vendor products are named, so the impact extends to any application integrating this release.

The CVSS score of 7.5 marks this as a high‑severity denial of service vulnerability. The EPSS score of < 1% indicates a very low likelihood of exploitation at this time, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is the delivery of a crafted JBIG2 image that triggers the integer overflow in the decoder; no special privileges are required, and the exploitation can occur whenever the host application processes such an image. These details are inferred from the description of the vulnerability.