CVE-2026-12600: Poppler PDF JPXDecode DoS Vulnerability

CVE-2026-12600 Overview

CVE-2026-12600 is a denial-of-service (DoS) vulnerability in the internal JPEG2000 (JPX) decoding implementation of the Poppler fork maintained by Innodata Labs. The flaw resides in the JPXStream::readCodestream() function, which trusts image dimension fields from the SIZ segment of a JPX codestream when allocating memory for tiles and components. A remote attacker who supplies a crafted PDF containing a malicious JPXDecode image can trigger uncontrolled memory consumption. The result is termination of the pdftoppm process, or any application embedding the affected library, through out-of-memory (OOM) conditions.

Critical Impact
Remote, unauthenticated attackers can crash PDF-processing pipelines by submitting a single malicious PDF, disrupting document conversion, indexing, and content-extraction services.

Affected Products

Innodata Labs Poppler fork (JPX decoder component)
pdftoppm and other utilities linking the affected Poppler fork
Downstream applications embedding the Innodata Labs Poppler fork for PDF rendering or conversion

Discovery Timeline

2026-08-25 - CVE-2026-12600 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-12600

Vulnerability Analysis

The vulnerability is a resource-exhaustion flaw [CWE-400] in the JPEG2000 (JPX) codestream parser of the Innodata Labs Poppler fork. JPEG2000 images embedded in PDFs are decoded through a JPXStream class that reads structural metadata from the SIZ (image and tile size) segment. Fields such as img.nComps, tile grid dimensions, and component counts drive downstream heap allocations for tile buffers and per-component state.

The decoder accepts these attacker-controlled values without enforcing sanity bounds against the actual codestream size or available system memory. A PDF containing a JPX image whose SIZ segment declares extreme values for component count or tile geometry forces the decoder to request very large heap allocations. The parent process, commonly pdftoppm, is then killed by the kernel OOM killer, halting document processing.

Root Cause

The root cause is missing validation of untrusted length and count fields in JPXStream::readCodestream(). The function propagates SIZ values into allocation calls without verifying that the requested totals are consistent with the codestream length or a configured upper bound. This turns a metadata-parsing routine into a memory-amplification primitive.

Attack Vector

Exploitation is network-reachable and requires no authentication or user interaction beyond delivering a PDF to a service that processes it. Any pipeline that renders, converts, or thumbnails uploaded PDFs, such as web-facing document converters, mail gateways, or search indexers, exposes the vulnerable code path. Successful exploitation degrades or halts the service by exhausting host memory. Technical details are documented in the INCIBE CERT Notice on uncontrolled memory usage in the Innodata Labs Poppler JPX decoder.

Detection Methods for CVE-2026-12600

Indicators of Compromise

Repeated OOM-killer events in dmesg or /var/log/messages referencing pdftoppm or other Poppler-linked processes.
Sudden spikes in resident set size (RSS) for PDF-processing workers immediately after ingesting a specific document.
Uploaded PDFs containing JPX-encoded images with anomalously large SIZ component counts or tile dimensions.

Detection Strategies

Inspect inbound PDFs for JPXDecode filters and parse the JPEG2000 SIZ segment to flag unreasonable nComps, Xsiz, Ysiz, or tile-count values before handing them to the renderer.
Correlate document-conversion job failures with concurrent memory pressure or OOM kills on the host to identify targeted DoS attempts.
Match process crash telemetry against the list of binaries linking the Innodata Labs Poppler fork.

Monitoring Recommendations

Alert on kernel OOM-killer activity targeting PDF-rendering processes across production hosts.
Track process memory ceilings and abnormal termination rates for pdftoppm and related tools.
Log the size, filter chain, and image-stream metadata of every PDF processed by public-facing services for post-incident analysis.

How to Mitigate CVE-2026-12600

Immediate Actions Required

Identify every service and container image that ships or links the Innodata Labs Poppler fork and inventory exposure.
Apply resource limits (cgroups, ulimit -v, or container memory caps) to any process that decodes untrusted PDFs so a single job cannot exhaust host memory.
Restrict or sandbox PDF-processing workers using seccomp, namespaces, or dedicated conversion microservices with restart supervision.

Patch Information

No vendor patch reference is listed in the NVD entry at the time of publication. Monitor the INCIBE CERT advisory and the Innodata Labs Poppler repository for a fixed release that adds bounds checking to JPXStream::readCodestream().

Workarounds

Pre-filter uploaded PDFs and reject documents containing JPXDecode streams when JPEG2000 support is not required.
Route PDF conversion through short-lived worker processes with hard memory limits and automatic restart on termination.
Where feasible, switch to an upstream Poppler build or an alternative renderer that is not affected by this specific implementation.

bash

# Configuration example: constrain pdftoppm memory usage via systemd
# /etc/systemd/system/pdf-worker.service
[Service]
MemoryMax=512M
MemorySwapMax=0
TasksMax=64
Restart=on-failure
ExecStart=/usr/bin/pdftoppm -r 150 %i /var/out/%i