USN-8894-1: poppler vulnerabilities · ZeroHour

Ubuntu Security Noticespublished Oct 7, 13:00 UTC (3d ago)ingested Oct 7, 17:57 UTC

USN-8894-1: poppler vulnerabilities

mediumAdvisoryimportance 32CVE-2026-102620 CVE-2026-102621 CVE-2026-93312

AI summary · grok-4.7

Ubuntu's USN-8894-1 fixes Poppler overflows and a null dereference that can crash or run code.

Ubuntu security notice USN-8894-1 describes vulnerabilities in Poppler. CVE-2026-102620 is an integer overflow in FoFiTrueType::cvtSfnts and CVE-2026-102621 is an integer overflow in SplashClip::clipToPath; either could crash Poppler or allow arbitrary code execution. CVE-2026-93312 is a null pointer dereference in JBIG2Stream that can cause a denial of service. The published notice text is truncated after introducing a further issue, and no exploitation is reported.

CVE-2026-102620 and CVE-2026-102621 are integer overflows that may allow code execution.
CVE-2026-93312 is a JBIG2Stream null dereference that can crash Poppler.
USN-8894-1 is a routine Ubuntu advisory; exploitation is not reported.

Read the original

VendorsCanonical

ProductsPoppler

OrganizationsUbuntu

Tags#ubuntu #poppler #usn-8894-1 #integer-overflow #denial-of-service #pdf

Vulnerabilities mentionedAll →

CVE-2026-1026201.9—
Integer overflow in Freedesktop Poppler TrueType handling
published 11d ago· Freedesktop Poppler
CVE-2026-1026211.9—
Integer overflow in Freedesktop Poppler SplashClip
published 11d ago· Freedesktop Poppler
CVE-2026-93312

Full article

It was discovered that Poppler had an integer overflow in FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-102620) It was discovered that Poppler had an integer overflow in SplashClip::clipToPath. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-102621) It was discovered that Poppler had a null pointer dereference in JBIG2Stream. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service. (CVE-2026-93312) It was discovered that Poppler had an…

This source does not provide full text. Read it at ubuntu.com.

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-102620

Integer overflow in Freedesktop Poppler TrueType handling

Freedesktop Poppler 26.06.0, 26.07.0, and 26.08.0 contain an integer overflow in FoFiTrueType::cvtSfnts in fofi/FoFiTrueType.cc, which handles TrueType font data. The flaw is triggered by manipulating that conversion path and can be reached only with local access and low privileges. CVSS 4.0 scores the impact as low integrity only (1.9), with no confidentiality or availability effect on the vulnerable component. Anyone running those Poppler releases, including systems that pull the library through Linux distribution packages, is affected. The advisory states that an exploit has been publicly disclosed and CVSS exploit maturity is Proof-of-Concept; it is not in the CISA KEV catalog, so widespread in-the-wild exploitation is not indicated.

Do: Install the upstream patch 245d3c6823377755f2c1d5fdddd010279c6ed94d, or the Poppler package update from your distribution (Ubuntu tracks this in USN-8894-1). Until then, avoid processing untrusted PDFs with affected Poppler builds; this is a local, low-severity issue and can follow normal patch cycles.

1.9

—

Freedesktop Poppler 26.06.0, 26.07.0, 26.08.0

massTens of millions of Linux systems that ship Poppler (order-of-magnitude estimate)

11d ago

CVE-2026-102621

Integer overflow in Freedesktop Poppler SplashClip

Freedesktop Poppler through 26.08.0 has an integer overflow in SplashClip::clipToPath in splash/SplashClip.cc. It is triggered by manipulating clip-path handling and can be exploited only from a local environment, with low privileges and no user interaction. Scored impact is limited to low availability of the local process, with no confidentiality or integrity impact. Distributions and applications shipping Poppler at or below 26.08.0 are affected, including those covered by Ubuntu USN-8894-1. The CNA states that an exploit is publicly available and CVSS 4.0 exploit maturity is Proof-of-Concept; the issue is not in CISA KEV, so confirmed in-the-wild use is not known.

Do: Upgrade Poppler to 26.09.0 or later (patch 323c91036d99926a8b90dc14329f7b40aece22f8) and apply distribution updates such as Ubuntu USN-8894-1. Until then, avoid processing untrusted PDFs with Poppler-based tools on shared or multi-user systems, because the issue is local and can disrupt availability of the rendering process.

1.9

—

Freedesktop Poppler up to 26.08.0

masstens of millions of Linux installations (library dependency)

11d ago

Null pointer dereference in Poppler JBIG2Stream

Freedesktop Poppler 26.07.0 has a null pointer dereference in JBIG2Stream::rewind (poppler/JBIG2Stream.cc), also tracked as improper resource shutdown (CWE-476 and CWE-404). A remote attacker can trigger it by getting a victim or an application to process a crafted PDF, with no privileges required and only passive user interaction. Impact is limited to low availability loss (the Poppler-using process can crash); confidentiality and integrity are not affected, and CVSS 4.0 rates it 2.1. Anyone running Poppler 26.07.0 is affected, including PDF tools on Linux distributions that shipped that release; 26.08.0 contains the fix. The CNA description states that an exploit has been published and CVSS exploit maturity is Proof-of-Concept, but the issue is not in CISA KEV and there is no confirmed in-the-wild exploitation.

Do: Upgrade Poppler from 26.07.0 to 26.08.0 (patch 5e49250f13b0390edeb3f90eb4c02c9941f97067) and install distribution updates, including those covered by Ubuntu USN-8894-1. Until then, avoid processing untrusted PDFs with Poppler-based tools and viewers.

2.1

—

Freedesktop Poppler 26.07.0

largeon the order of 100,000–1,000,000+ systems that may have installed Poppler 26.07.0 (exact count unknown)

23d ago