Description
A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat AI Inference Server 3.3 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 26.01.0-4.1 | — |
| Debian 13 | poppler | 25.03.0-5+deb13u3 | — |
| Debian 12 | poppler | 22.12.0-2+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | poppler | 26.01.0-2ubuntu0.1 | USN-8400-1 |
| Ubuntu 25.10 | poppler | 25.03.0-10ubuntu0.2 | USN-8400-1 |
| Ubuntu 24.04 LTS | poppler | 24.02.0-1ubuntu9.9 | USN-8400-1 |
| Ubuntu 22.04 LTS | poppler | 22.02.0-2ubuntu0.13 | USN-8400-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | poppler | No fix yet | — |
| Ubuntu Pro 18.04 LTS | poppler | No fix yet | — |
| Ubuntu Pro 16.04 LTS | poppler | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | poppler +9 | 24.02.0-7.el10_2.2 | RHSA-2026:24985 |
| RHEL 9 | poppler +9 | 21.01.0-24.el9_8.1 | RHSA-2026:25058 |
| RHEL 8 | poppler +9 | 20.11.0-14.el8_10 | RHSA-2026:24984 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | poppler +9 | 24.02.0-7.el10_0.1 | RHSA-2026:27720 |
| RHEL 9.6 EUS | poppler +9 | 21.01.0-22.el9_6.1 | RHSA-2026:27721 |
| RHEL 9.4 E4S | poppler +4 | 21.01.0-20.el9_4.1 | RHSA-2026:27722 |
| RHEL 9.2 E4S | poppler +4 | 21.01.0-15.el9_2.1 | RHSA-2026:27723 |
| RHEL 8.8 TUS | poppler +3 | 20.11.0-7.el8_8.1 | RHSA-2026:27724 |
| RHEL 8.8 E4S | poppler +3 | 20.11.0-7.el8_8.1 | RHSA-2026:27724 |
| RHEL 8.6 EUS Long Life | poppler +2 | 20.11.0-5.el8_6.1 | RHSA-2026:27725 |
| RHEL 8.6 AUS | poppler +2 | 20.11.0-5.el8_6.1 | RHSA-2026:27725 |
| RHEL 8.4 EUS Long Life | poppler +2 | 20.11.0-2.el8_4.3 | RHSA-2026:27727 |
| RHEL 8.4 AUS | poppler +2 | 20.11.0-2.el8_4.3 | RHSA-2026:27727 |
| RHEL 7 ELS | compat-poppler022 +3 | 0.22.5-7.el7_9 | RHSA-2026:29952 |
| RHEL 7 ELS | poppler +9 | 0.26.5-44.el7_9 | RHSA-2026:30044 |
| Red Hat Hardened Images 1 | poppler +9 | 26.06.0-0.1.hum1 | RHSA-2026:30134 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | poppler +9 | 24.02.0-7.el10_2.2 | ALSA-2026:24985 |
| AlmaLinux 9 | poppler +9 | 21.01.0-24.el9_8.1 | ALSA-2026:25058 |
| AlmaLinux 8 | poppler +9 | 20.11.0-14.el8_10 | ALSA-2026:24984 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | poppler | 24.02.0-7.el10_2.2 | RLSA-2026:24985 |
| Rocky Linux 9 | poppler | 21.01.0-24.el9_8.1 | RLSA-2026:25058 |
| Rocky Linux 8 | poppler | 20.11.0-14.el8_10 | RLSA-2026:24984 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | compat-poppler22 +1 | 22.08.0-3.amzn2023.0.6 | ALAS2023-2026-1851 |
| Amazon Linux 2023 | poppler +7 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 |
| Amazon Linux 2 | poppler +9 | 0.26.5-43.amzn2.1.7 | ALAS2-2026-3362 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | poppler +9 | 24.02.0-7.el10_2.2 | ELSA-2026-24985 |
| Oracle Linux 9 | poppler +9 | 21.01.0-24.el9_8.1 | ELSA-2026-25058 |
| Oracle Linux 8 | poppler +9 | 20.11.0-14.el8_10 | ELSA-2026-24984 |
| Oracle Linux 7 | compat-poppler022 +3 | 0.22.5-4.0.1.el7 | ELSA-2026-29952 |
| Oracle Linux 7 | poppler +9 | 0.26.5-43.0.1.el7.1 | ELSA-2026-30044 |
Advisories 29
- ALSA-2026:25058 Important: poppler security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:24985 Important: poppler security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:24984 Important: poppler security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:30134 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:30044 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:29952 Red Hat Security Advisory: compat-poppler022 security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:27727 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:27725 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:27723 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:27724 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:27722 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:27720 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:27721 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:25058 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:24984 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:24985 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2026-1867 Red Hat Enterprise Linux (Poppler): Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Aug 2, 2026
- ELSA-2026-29952 Important: compat-poppler022 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 22, 2026
- ELSA-2026-30044 Important: poppler security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 21, 2026
- ELSA-2026-24985 Important: poppler security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- ELSA-2026-25058 Important: poppler security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- ALAS2-2026-3362 Important: poppler security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- ALAS2023-2026-1851 Important: compat-poppler22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- ALAS2023-2026-1852 Important: poppler security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- RLSA-2026:25058 Important: poppler security update Rocky Linux Security Advisories · Jun 13, 2026
- RLSA-2026:24985 Important: poppler security update Rocky Linux Security Advisories · Jun 13, 2026
- RLSA-2026:24984 Important: poppler security update Rocky Linux Security Advisories · Jun 12, 2026
- ELSA-2026-24984 Important: poppler security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 10, 2026
- USN-8400-1 poppler vulnerability Ubuntu Security Notices (USN) · Jun 8, 2026
References
- RHSA-2026:24984 vendor-advisory
- RHSA-2026:24985 vendor-advisory
- RHSA-2026:25058 vendor-advisory
- RHSA-2026:27720 vendor-advisory
- RHSA-2026:27721 vendor-advisory
- RHSA-2026:27722 vendor-advisory
- RHSA-2026:27723 vendor-advisory
- RHSA-2026:27724 vendor-advisory
- RHSA-2026:27725 vendor-advisory
- RHSA-2026:27727 vendor-advisory
- RHSA-2026:29952 vendor-advisory
- RHSA-2026:30044 vendor-advisory
- RHSA-2026:30078 vendor-advisory
- RHSA-2026:30087 vendor-advisory
- RHSA-2026:30088 vendor-advisory
- RHSA-2026:30089 vendor-advisory
- RHSA-2026:30134 vendor-advisory
- RHSA-2026:74674 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-10118 vdb-entry
- RHBZ#2460428 issue-tracking
- https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715