Critical UNKNOWN READ Vulnerability in Poppler Package
Summary
OSV-2026-461: UNKNOWN READ in XRef::constructObjectEntry. Affects poppler versions >= 1c6e5df94e06c9ad7e5af6aabfe38409532a85de, < 13313aefb1558f1281a076151a03d5b90788e7e0. Fixed in 13313aefb1558f1281a076151a03d5b90788e7e0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Poppler is a widely used open-source PDF rendering library that provides functionalities for handling PDF documents. It is utilized in various applications for rendering PDF files, extracting text, and manipulating PDF content. The library is known for its performance and compatibility with different PDF standards. However, like many software libraries, it is susceptible to vulnerabilities that can lead to security risks, such as unauthorized access to memory or data corruption.
Vulnerability Detail
The vulnerability identified as UNKNOWN READ in the XRef::constructObjectEntry function of the Poppler library can lead to unexpected behavior, including crashes or potential data leaks. This issue was reported through OSS-Fuzz, highlighting a crash state that occurs during the processing of PDF files. The root cause of this vulnerability lies in improper handling of memory references, which can be exploited by maliciously crafted PDF documents, potentially leading to unauthorized access to sensitive information or application crashes.
How To Fix
Minimum fixed version
13313aefb1558f1281a076151a03d5b90788e7e0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted or unknown PDF files until the vulnerability is patched. This can help mitigate the risk of exploitation until an update is applied.
Conclusion
The UNKNOWN READ vulnerability in the Poppler package poses a significant risk to applications that process PDF files. Users are strongly advised to update to the patched version to mitigate potential security threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for poppler →
FAQ
The UNKNOWN READ vulnerability allows for potential unauthorized access to memory, leading to application crashes or data leaks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, avoid processing untrusted PDF files as a temporary workaround.
Yes, the vulnerability has been classified with a medium severity level, indicating that it poses a significant risk if exploited.
You can find more information on the official Poppler repository and security advisories related to the library.
References
Related vulnerabilities
Recent vulnerabilities recorded for poppler.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
