CVE-2026-85458 in Xpdf
Summary
by MITRE • 09/04/2026
Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified as CVE-2021-3785 represents a critical arithmetic error within the PDF rendering engine of Xpdf, specifically affecting versions up to and including 4.06. This flaw is rooted in the handling of Type 3 fonts, which are defined by custom glyph descriptions rather than standard metric data. When an attacker crafts a malicious PDF document containing a Type 3 font with a specific geometric configuration where the calculated height of a glyph resolves to zero, the rendering engine fails to perform adequate input validation before executing division operations based on these dimensions. This lack of boundary checking leads directly to a divide-by-zero exception during the rasterization or layout calculation phase of text processing.
From a technical perspective, this issue falls under the category of CWE-369, which denotes an error condition that results in a denial of service due to division by zero. In the context of Xpdf, the parser processes font metrics and glyph bounding boxes to determine how characters should be displayed on the page. When the height parameter is explicitly set to zero or calculated as such through malformed data structures, subsequent mathematical operations intended for scaling or positioning glyphs attempt to divide by this null value. On many systems, particularly those running Linux-based environments where Xpdf is commonly deployed, unhandled arithmetic exceptions typically cause the application process to terminate abruptly rather than continuing execution in a potentially compromised state.
The operational impact of this vulnerability is primarily characterized as a denial-of-service condition against users who open or render maliciously crafted PDF files. While modern web browsers and document viewers often employ sandboxing techniques that may limit the immediate consequences, an unsandboxed instance of Xpdf will crash upon encountering such input. This disruption prevents legitimate access to documents and can be leveraged by threat actors to disrupt workflows in environments relying on automated PDF processing pipelines or legacy systems where stability is paramount for continuous operation. The attack vector requires social engineering or drive-by download tactics to deliver the malformed document, aligning with MITRE ATT&CK technique T1204, which covers user execution of malicious files.
Mitigation strategies focus heavily on updating the underlying software components and implementing defensive coding practices. Organizations should immediately upgrade Xpdf to version 4.07 or later, where this arithmetic check has been corrected to handle zero-height glyphs gracefully without triggering exceptions. For environments unable to patch immediately, deploying network-level filtering solutions that inspect PDF payloads for anomalous font structures can provide a layer of defense. Additionally, developers integrating Xpdf into larger applications should ensure they are using the latest stable release and consider implementing external sandboxing mechanisms to isolate the rendering process from critical system resources, thereby containing any potential crashes within a non-privileged context.