Critical Integer Overflow Vulnerability in Poppler Package Leading to Heap Buffer Overflow
Summary
ALSA-2026:24984: Important: poppler security update. Affects poppler versions < 20.11.0-14.el8_10. Fixed in 20.11.0-14.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Poppler is a widely used Portable Document Format (PDF) rendering library that enables applications like Evince to display PDF documents. It is known for its efficiency and compatibility with various systems. However, it has recently been identified as vulnerable to an integer overflow issue that can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from an integer overflow in the Poppler SplashOutputDev::tilingPatternFill function. This flaw allows for unchecked dimension multiplication, which can result in a heap buffer overflow. If exploited, this vulnerability could allow an attacker to execute arbitrary code, potentially compromising the integrity and confidentiality of the affected system.
How To Fix
Minimum fixed version
20.11.0-14.el8_10
This is the first release that contains the fix.
sudo dnf update popplerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of applications relying on the vulnerable Poppler library until the package is updated. Additionally, ensuring that the system is not exposed to untrusted PDF files can help mitigate the risk.
Conclusion
The identified vulnerability in the Poppler package poses significant security risks due to its potential for arbitrary code execution. Users are strongly advised to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for poppler →
FAQ
The vulnerability is an integer overflow that can lead to a heap buffer overflow, allowing potential arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
Failure to address this vulnerability could lead to unauthorized access, data breaches, and potential system compromise.
Yes, the vulnerability is fixed in version 20.11.0-14.el8_10 of the Poppler package.
If an immediate update is not possible, limit the use of applications that depend on Poppler and avoid opening untrusted PDF files.
Related vulnerabilities
Recent vulnerabilities recorded for poppler.
