Description
A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Freedesktop | Poppler | 26.07.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 26.07.0-3 | — |
| Debian 13 | poppler | No fix yet | — |
| Debian 12 | poppler | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | poppler | 26.01.0-2ubuntu0.2 | USN-8894-1 |
| Ubuntu 24.04 LTS | poppler | 24.02.0-1ubuntu9.10 | USN-8894-1 |
| Ubuntu 22.04 LTS | poppler | 22.02.0-2ubuntu0.14 | USN-8894-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | poppler | No fix yet | — |
| Ubuntu Pro 18.04 LTS | poppler | No fix yet | — |
| Ubuntu Pro 16.04 LTS | poppler | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | poppler +9 | 26.08.0-1.hum1 | RHSA-2026:58482 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | poppler | 0.79.0-150200.3.56.1 | SUSE-SU-2026:5176-1, SUSE-SU-2026:5133-1 |
| SLES 15 SP7 | poppler-qt5 +1 | 24.03.0-150600.3.34.1 | SUSE-SU-2026:5133-1 |
| SLES 12 SP5 | poppler +1 | 0.43.0-16.77.1 | SUSE-SU-2026:5175-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | poppler | 26.09.0-2.1 | openSUSE-SU-2026:11885-1 |
Advisories 7
- SUSE-SU-2026:5176-1 Security update for poppler, poppler-qt5 SUSE / openSUSE Security Updates · Nov 11, 2026
- SUSE-SU-2026:5175-1 Security update for poppler, poppler-qt, poppler-qt5 SUSE / openSUSE Security Updates · Nov 11, 2026
- WID-SEC-2026-3454 poppler: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Nov 10, 2026
- SUSE-SU-2026:5133-1 Security update for poppler SUSE / openSUSE Security Updates · Nov 10, 2026
- USN-8894-1 poppler vulnerabilities Ubuntu Security Notices (USN) · Oct 8, 2026
- openSUSE-SU-2026:11885-1 libpoppler-cpp3-26.09.0-2.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026
- RHSA-2026:58482 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 24, 2026
References
- VDB-406613 | Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow vdb-entry technical-description
- VDB-406613 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-93314 | CVE Analysis and Report third-party-advisory
- Submit #942347 | freedesktop.org Poppler 26.07.0 Integer Overflow third-party-advisory
- https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1761 related
- https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2315 patch
- https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-mapCodeToGID-FoFiTrueType.cc-608.md exploit
- https://gitlab.freedesktop.org/poppler/poppler/-/commit/ed2a5538cf0a8d3ff908191eda9b73f91a5f952a?merge_request_iid=2315 patch