Critical Vulnerability in Poppler Package: Integer Overflow Leading to Heap Buffer Overflow
Summary
ALSA-2026:24985: Important: poppler security update. Affects poppler versions < 24.02.0-7.el10_2.2. Fixed in 24.02.0-7.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Poppler is a widely-used Portable Document Format (PDF) rendering library that is integral to various applications, including Evince. It provides functionalities for rendering PDF documents and is essential for applications that require PDF manipulation and viewing. However, like many software libraries, it is susceptible to vulnerabilities that can compromise the security and stability of applications relying on it.
Vulnerability Detail
The vulnerability arises from an integer overflow in the Poppler SplashOutputDev::tilingPatternFill function. This flaw can lead to a heap buffer overflow due to unchecked dimension multiplication, potentially allowing an attacker to execute arbitrary code or crash the application. The issue is classified under CVE-2026-10118, indicating its severity and the need for immediate attention.
How To Fix
Minimum fixed version
24.02.0-7.el10_2.2
This is the first release that contains the fix.
sudo dnf update popplerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider disabling features that utilize the vulnerable function until the package can be updated. However, this is not a permanent solution and should be followed by an update as soon as possible.
Conclusion
The identified vulnerability in the Poppler package poses significant risks, including potential arbitrary code execution. It is imperative for users to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for poppler →
FAQ
The vulnerability is an integer overflow that can lead to a heap buffer overflow, potentially allowing for arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Failure to address this vulnerability could result in application crashes or exploitation by attackers, leading to unauthorized access or data breaches.
Yes, updating to version 24.02.0-7.el10_2.2 or later will resolve this vulnerability.
If an immediate update is not possible, consider disabling features that rely on the vulnerable function as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for poppler.
