Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-10118: A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | compat-poppler22 | 0:22.08.0-3.amzn2023.0.6 |
| Amazon Linux · 2023 | compat-poppler22-cpp | 0:22.08.0-3.amzn2023.0.6 |
| Amazon Linux · 2023 | compat-poppler22-cpp-debuginfo | 0:22.08.0-3.amzn2023.0.6 |
| Amazon Linux · 2023 | compat-poppler22-debuginfo | 0:22.08.0-3.amzn2023.0.6 |
| Amazon Linux · 2023 | compat-poppler22-debugsource | 0:22.08.0-3.amzn2023.0.6 |
Vulnerabilities 1
-
High 7.8
Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication
A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-10118.html