CVE-2026-38076: Artifex Integer Overflow Denial of Service Vulnerability

Technical summary

CVE-2026-38076 is an integer overflow vulnerability in the jbig2_arith_iaid_ctx_new() function within Artifex commit cc37d0. Integer overflows in memory allocation contexts can cause incorrect buffer sizing, leading to out-of-bounds access or crashes. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound). With a CVSS v3.1 score of 7.5 and a network-accessible attack vector requiring no privileges or user interaction, this qualifies as a high-severity availability threat. The vulnerability does not compromise confidentiality or integrity.

Business impact

This vulnerability enables remote denial-of-service attacks against systems running the affected Artifex software. Organizations relying on Artifex for document processing or rendering workflows could experience service interruptions if exploited. The lack of authentication requirements means attackers can initiate attacks without credentials, and the ease of exploitation (low attack complexity) increases the operational risk. While data loss or compromise is not possible, downtime can disrupt batch processing, document workflows, and user-facing services.

Affected systems

Artifex software at commit cc37d0 is confirmed vulnerable. The source data does not enumerate specific product versions or distributions; verify affected product versions and deployment scope against the official Artifex advisory. Any system running vulnerable versions of Artifex that processes untrusted JBIG2-encoded data or documents is at risk.

Exploitability

The vulnerability has a low attack complexity and requires no authentication or user interaction—an attacker can exploit it by sending a malicious input over the network. However, the CISA KEV catalog does not currently list this vulnerability, indicating it is not yet tracked as actively exploited in the wild. This does not diminish the urgency of remediation; it reflects the current threat landscape rather than the risk posed by the vulnerability itself. Organizations should treat this as a proactive security issue rather than a reactive incident response.

Remediation

Patch the Artifex software to a version that resolves this integer overflow. Verify the specific patched version against the official Artifex advisory. Until patching is possible, limit network exposure of systems running Artifex, restrict input to trusted sources, and monitor for anomalous resource consumption or service crashes that may indicate exploitation attempts.

Patch guidance

Contact Artifex or consult their official security advisories for the specific patched version that addresses commit cc37d0's vulnerability. Apply patches to all systems running the affected code. Test in a non-production environment before deployment. If Artifex provides mitigating configuration changes or input validation hardening, implement those as an interim measure while patches are staged.

Detection guidance

Monitor Artifex processes for unexpected terminations or crashes, particularly when processing JBIG2-encoded documents or crafted inputs. Log network requests to systems running Artifex and correlate with service availability. Network-based detection is challenging without payload inspection; focus on behavioral anomalies such as repeated service restarts or denial-of-service patterns. Implement input validation to reject malformed JBIG2 streams before they reach the vulnerable function.

Why prioritize this

Despite not being on the CISA KEV list, this vulnerability merits near-term patching due to its high CVSS score (7.5), network accessibility, and lack of authentication barriers. The combination of ease of exploitation and guaranteed availability impact makes it a suitable candidate for immediate patch planning. Organizations should prioritize based on whether they deploy Artifex in internet-facing or untrusted-input-processing roles.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects a network-accessible denial-of-service vulnerability with low attack complexity and no privilege or user-interaction requirements. The vector AV:N/AC:L/PR:N/UI:N indicates maximum exploitability. The A:H (availability impact: high) component confirms complete service disruption is possible. The C:N/I:N components indicate confidentiality and integrity are unaffected, preventing a critical rating. This score appropriately captures the operational risk posed by a remote, unauthenticated DoS vector.

Frequently asked questions