Heap Buffer Overflow Vulnerability in Poppler Package - Important Security Update
Summary
ALSA-2026:25058: Important: poppler security update. Affects poppler versions < 21.01.0-24.el9_8.1. Fixed in 21.01.0-24.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Poppler is a widely used Portable Document Format (PDF) rendering library that supports various applications, including Evince. It provides essential functionalities for rendering PDF documents and is integral to many software solutions. However, it has been identified that certain versions of Poppler are susceptible to a critical vulnerability that can lead to severe security issues.
Vulnerability Detail
The vulnerability arises from an integer overflow in the Poppler SplashOutputDev::tilingPatternFill function. This flaw can lead to a heap buffer overflow due to unchecked dimension multiplication, potentially allowing an attacker to execute arbitrary code or crash the application. The specific identifier for this vulnerability is CVE-2026-10118, which highlights its critical nature and the need for immediate attention.
How To Fix
Minimum fixed version
21.01.0-24.el9_8.1
This is the first release that contains the fix.
sudo dnf update popplerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the specific functionalities that trigger the vulnerability until the update is applied. However, the best course of action is to update to the patched version as soon as possible.
Conclusion
In summary, the identified vulnerability in the Poppler package poses significant risks that necessitate immediate action. Users are strongly encouraged to update to the latest patched version to safeguard their applications from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for poppler →
FAQ
The vulnerability is an integer overflow that can lead to a heap buffer overflow, potentially allowing attackers to execute arbitrary code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Failure to address this vulnerability may result in unauthorized access, data breaches, or application crashes, compromising the security of your system.
Yes, the patched version is 21.01.0-24.el9_8.1. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, refrain from using the affected functionalities and monitor for any unusual activity in your applications.
Related vulnerabilities
Recent vulnerabilities recorded for poppler.
