Poppler (Product): news timeline & CVEs

USN-8894-1: poppler vulnerabilities

Ubuntu's USN-8894-1 fixes Poppler overflows and a null dereference that can crash or run code.

Ubuntu security notice USN-8894-1 describes vulnerabilities in Poppler. CVE-2026-102620 is an integer overflow in FoFiTrueType::cvtSfnts and CVE-2026-102621 is an integer overflow in SplashClip::clipToPath; either could crash Poppler or allow arbitrary code execution. CVE-2026-93312 is a null pointer dereference in JBIG2Stream that can cause a denial of service. The published notice text is truncated after introducing a further issue, and no exploitation is reported.

Ubuntu Security NoticesOct 7, 13:00 UTC · 3d agoAdvisory CVE-2026-102620 CVE-2026-102621 CVE-2026-933121

Codex bundles LibreOffice

OpenAI's Codex desktop app bundles 1.7GB of runtimes including full Python, Node.js, Poppler, git, and LibreOffice binaries.

Blogger Simon Willison found that the OpenAI Codex desktop app (since rebranded to ChatGPT) keeps about 1.7GB in a ~/.cache/codex-runtimes/codex-primary-runtime folder, including full Python and Node.js installations plus native binaries for Poppler, git, and the LibreOffice office suite. Bundled skills in the plugins directory instruct Codex on how to find and use these binaries. The observation highlights the heavyweight local runtime stack shipped with agentic coding tools.

Simon WillisonSep 1, 19:03 UTC · Sep 1, 2026AI tools & infra1

Poppler

Timeline2 articles

Related CVEsby mentions

Appears with

USN-8894-1: poppler vulnerabilities

Codex bundles LibreOffice