Description
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Freedesktop | Poppler | 26.08 | 26.09.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 26.07.0-3 | — |
| Debian 13 | poppler | No fix yet | — |
| Debian 12 | poppler | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | poppler | 26.01.0-2ubuntu0.2 | USN-8894-1 |
| Ubuntu 24.04 LTS | poppler | 24.02.0-1ubuntu9.10 | USN-8894-1 |
| Ubuntu 22.04 LTS | poppler | 22.02.0-2ubuntu0.14 | USN-8894-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | poppler | No fix yet | — |
| Ubuntu Pro 18.04 LTS | poppler | No fix yet | — |
| Ubuntu Pro 16.04 LTS | poppler | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | poppler +9 | 26.08.0-1.2.hum1 | RHSA-2026:74469 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | poppler | 0.79.0-150200.3.56.1 | SUSE-SU-2026:5176-1, SUSE-SU-2026:5133-1 |
| SLES 15 SP7 | poppler-qt5 +1 | 24.03.0-150600.3.34.1 | SUSE-SU-2026:5133-1 |
| SLES 12 SP5 | poppler +1 | 0.43.0-16.77.1 | SUSE-SU-2026:5175-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | poppler | 26.09.0-3.1 | openSUSE-SU-2026:11968-1 |
Advisories 7
- SUSE-SU-2026:5176-1 Security update for poppler, poppler-qt5 SUSE / openSUSE Security Updates · Nov 11, 2026
- SUSE-SU-2026:5175-1 Security update for poppler, poppler-qt, poppler-qt5 SUSE / openSUSE Security Updates · Nov 11, 2026
- WID-SEC-2026-3674 poppler: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Nov 10, 2026
- SUSE-SU-2026:5133-1 Security update for poppler SUSE / openSUSE Security Updates · Nov 10, 2026
- USN-8894-1 poppler vulnerabilities Ubuntu Security Notices (USN) · Oct 8, 2026
- openSUSE-SU-2026:11968-1 libpoppler-cpp3-26.09.0-3.1 on GA media SUSE / openSUSE Security Updates · Oct 3, 2026
- RHSA-2026:74469 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 2, 2026
References
- VDB-411411 | Freedesktop Poppler SplashClip.cc clipToPath integer overflow vdb-entry technical-description
- VDB-411411 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-102621 | CVE Analysis and Report third-party-advisory
- Submit #942349 | freedesktop.org Poppler 26.07.0 Integer Overflow third-party-advisory
- https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1763 related
- https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2325 patch
- https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-SplashClip-clipToPath-SplashClip.cc-214.md exploit
- https://gitlab.freedesktop.org/poppler/poppler/-/commit/323c91036d99926a8b90dc14329f7b40aece22f8 patch