Skip to content
OpenAdvisories
High ALAS2023-2026-1852 1 CVE

Important: poppler security update (Amazon Linux 2023)

Published Jun 22, 2026 · Updated Jun 22, 2026

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-10118: A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

Fixed packages 13

ReleasePackageFixed in
Amazon Linux · 2023 poppler 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-cpp 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-cpp-debuginfo 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-cpp-devel 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-debuginfo 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-debugsource 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-devel 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-glib 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-glib-debuginfo 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-glib-devel 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-glib-doc 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-utils 0:24.08.0-1.amzn2023.0.1
Amazon Linux · 2023 poppler-utils-debuginfo 0:24.08.0-1.amzn2023.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-10118.html