Skip to content
OpenAdvisories
Medium USN-8950-1 1 CVE

poppler vulnerability

Published Oct 21, 2026 · Updated Oct 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that poppler incorrectly handled the password length
limit when decrypting certain encrypted PDF files. An attacker could
possibly use this issue to cause a denial of service.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS poppler 22.02.0-2ubuntu0.15
Ubuntu · 24.04 LTS 24.04:LTS poppler 24.02.0-1ubuntu9.11
Ubuntu · 26.04 LTS 26.04:LTS poppler 26.01.0-2ubuntu0.3
Ubuntu · 26.10 poppler 26.07.0-2ubuntu1.1

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-107705

    Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()

    Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 by…

    Freedesktop Poppler poppler poppler Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-107705