AIKIDO-2026-663140

TL;DR

pdf_load_image_imp in pdf-image.c computes the unpack buffer size for PDF image pixel data with narrow integer arithmetic that can silently wrap for large or crafted width, height, or bit-depth values, even though a later sanity check assumes no overflow. The undersized size is then used to allocate the destination buffer, so unpacking the image overruns the heap. The fix uses overflow-safe size calculation before allocating the unpack buffer.