An out‑of‑bounds array write exists in Xpdf 4.06 and earlier caused by incorrect validation of the "N" field in ICCBased color spaces. The vulnerability can corrupt memory, leading to crashes or potentially exploitable conditions. It is categorized as CWE‑20 (Improper Input Validation) and CWE‑787 (Out‑of‑Bounds Write). The CVSS score of 2.1 reflects a low overall risk and no known exploitation impact beyond application instability.

The affected vendor is Xpdf and the product is Xpdf Reader. All versions 4.06 and earlier are vulnerable.

The CVSS score is 2.1, indicating low severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. No exploit has been documented, and the attack vector is not explicitly stated; it is likely restricted to local use of the vulnerable Xpdf binary with a malicious PDF file. The risk remains limited to non‑remote code execution and potential denial of service in the affected application.