CVE-2026-93312: Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference
Vulnerability summary
CVE-2026-93312 is a medium (CVSS 5.3) Improper Resource Shutdown or Release vulnerability in freedesktop poppler. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 18-09-2026PublishedVulnerability first disclosed.
- 22-09-2026Last modifiedVulnerability information updated.
Description
A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.
CVSS metrics
10 scores · 4 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST2.1LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
- NVDNIST5.0MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
Increase +0.07 pp
From 0.34% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundCve Summit
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- popplerAll versions (No fix recorded) | < 26.07.0-3
Freedesktop1 product
- poppler26.07.0
Ubuntu1 product
- popplerAll versions (No fix recorded) | < 22.02.0-2ubuntu0.14 | < 24.02.0-1ubuntu9.10 | < 26.01.0-2ubuntu0.2
3 vendors · 3 products
