Summary
It was discovered that Poppler had an integer overflow in
FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to
cause Poppler to crash, resulting in a denial of service, or execute
arbitrary code.
(CVE-2026-102620)
It was discovered that Poppler had an integer overflow in
SplashClip::clipToPath. An attacker could possibly use this issue to
cause Poppler to crash, resulting in a denial of service, or execute
arbitrary code.
(CVE-2026-102621)
It was discovered that Poppler had a null pointer dereference in
JBIG2Stream. An attacker could possibly use this issue to cause
Poppler to crash, resulting in a denial of service.
(CVE-2026-93312)
It was discovered that Poppler had an integer overflow in
JBIG2Stream::readCodeTableSeg. An attacker could possibly use this
issue to cause Poppler to crash, resulting in a denial of service,
or execute arbitrary code.
(CVE-2026-93313)
It was discovered that Poppler had an integer overflow in
FoFiTrueType::mapCodeToGID. An attacker could possibly use this
issue to cause Poppler to crash, resulting in a denial of service,
or execute arbitrary code.
(CVE-2026-93314)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | poppler | 22.02.0-2ubuntu0.14 |
| Ubuntu · 24.04 LTS 24.04:LTS | poppler | 24.02.0-1ubuntu9.10 |
| Ubuntu · 26.04 LTS 26.04:LTS | poppler | 26.01.0-2ubuntu0.2 |
Vulnerabilities 5
-
Medium 6.3
Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow
A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The e…
-
Medium 6.3
Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow
A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remo…
-
Medium 4.3
Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference
A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been publ…
-
Low 3.3
Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow
A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit h…
-
Low 3.3
Freedesktop Poppler SplashClip.cc clipToPath integer overflow
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The …