Freedesktop Poppler vulnerabilities, page 5
96 vulnerabilities
Known vulnerabilities in Freedesktop Poppler, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2019-9903canonical · ubuntu_linux +9 morecanonical ubuntu_linuxPDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.EPSS2.41%CriticalCVE-2019-9631debian · poppler +4 moredebian popplerPoppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.EPSS3.52%HighCVE-2019-14494canonical · ubuntu_linux +31 morecanonical ubuntu_linuxAn issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.EPSS2.68%HighCVE-2019-7310canonical · ubuntu_linux +12 morecanonical ubuntu_linuxIn Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.EPSS2.07%HighCVE-2019-10872debian · poppler +2 moredebian popplerAn issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc.EPSS2.71%MediumCVE-2019-10873debian · poppler +1 moredebian popplerAn issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc.EPSS2.65%MediumCVE-2019-10871debian · poppler +2 moredebian popplerAn issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.EPSS2.49%HighCVE-2019-12293debian · poppler +2 moredebian popplerIn Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.EPSS2.09%MediumCVE-2026-102620debian · poppler +2 moreFreedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflowA vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.EPSS0.11%MediumCVE-2026-102621debian · poppler +2 moreFreedesktop Poppler SplashClip.cc clipToPath integer overflowA vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.EPSS0.11%HighCVE-2026-93314debian · poppler +2 moreFreedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflowA vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.EPSS0.24%HighCVE-2026-93313debian · poppler +12 moreFreedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflowA vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch.EPSS0.24%MediumCVE-2026-93311debian · poppler +12 moreFreedesktop Poppler SampledFunction Function.cc integer overflowA vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.EPSS0.56%MediumCVE-2026-93312debian · poppler +2 moreFreedesktop Poppler JBIG2Stream.cc rewind null pointer dereferenceA flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.EPSS0.40%HighCVE-2026-107705debian · poppler +13 morePoppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.EPSS0.33%MediumCVE-2023-34872debian · poppler +9 moredebian popplerA vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.EPSS0.91%