CVE-2026-93312: Null pointer dereference in Poppler JBIG2Stream · ZeroHour

CVE-2026-93312

large

Null pointer dereference in Poppler JBIG2Stream

CVSS 4.0

2.1 low

EPSS

—

Published

Sep 18, 2026 (23d ago)

Modified

Sep 22, 2026

AI analysis

Freedesktop Poppler 26.07.0 has a null pointer dereference in JBIG2Stream::rewind (poppler/JBIG2Stream.cc), also tracked as improper resource shutdown (CWE-476 and CWE-404). A remote attacker can trigger it by getting a victim or an application to process a crafted PDF, with no privileges required and only passive user interaction. Impact is limited to low availability loss (the Poppler-using process can crash); confidentiality and integrity are not affected, and CVSS 4.0 rates it 2.1. Anyone running Poppler 26.07.0 is affected, including PDF tools on Linux distributions that shipped that release; 26.08.0 contains the fix. The CNA description states that an exploit has been published and CVSS exploit maturity is Proof-of-Concept, but the issue is not in CISA KEV and there is no confirmed in-the-wild exploitation.

What to do: Upgrade Poppler from 26.07.0 to 26.08.0 (patch 5e49250f13b0390edeb3f90eb4c02c9941f97067) and install distribution updates, including those covered by Ubuntu USN-8894-1. Until then, avoid processing untrusted PDFs with Poppler-based tools and viewers.

Affected

Freedesktop Poppler

26.07.0

Estimated exposure

largeon the order of 100,000–1,000,000+ systems that may have installed Poppler 26.07.0 (exact count unknown) — Poppler is the standard PDF library on Linux desktops and many document pipelines (viewers, LibreOffice, CUPS, pdftotext), and Ubuntu issued USN-8894-1, but there is no public census of how many systems actually installed the single…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.

Weakness: CWE-404, CWE-476
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-93312

In the news1 stories

USN-8894-1: poppler vulnerabilities