CVE-2024-6239

Poppler: pdfinfo: crash in broken documents when using -dests parameter

A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Freedesktop Redhat

Products

Poppler Enterprise Linux Rhel Els

CVE-2026-107705

Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()

Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2026-102620

Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow

A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2026-102621

Freedesktop Poppler SplashClip.cc clipToPath integer overflow

A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2026-93312

Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference

A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2026-93311

Freedesktop Poppler SampledFunction Function.cc integer overflow

A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2026-93314

Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow

A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2026-93313

Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow

A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2007-3387

xpdf integer overflow

Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.

CVSS 2.0 · 6.8 Medium EPSS 8.6% KEV · Not listed

Vendors

Apple Canonical Debian and 4 more

Products

Cups Ubuntu Linux Debian Linux and 4 more

CVE-2025-50422

poppler: Poppler crash on malformed input

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2025-52886

Poppler Use After Free Vulnerability

Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

CVSS 4.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop Poppler

Products

Poppler Poppler

CVE-2023-34872

poppler: Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.

A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2025-32365

poppler: Out-of-Bounds Read in Poppler

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2025-32364

poppler: Floating-Point Exception in Poppler

A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2024-56378

Poppler: out-of-bounds read

libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop Poppler

Products

Poppler Poppler

CVE-2022-38349

poppler: Reachable assertion in Object.h

An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2022-37052

poppler: reachable assertion due to a failure in markObject()

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Freedesktop

Products

Poppler

CVE-2022-37051

poppler: abort in main() in pdfunite.cc

An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Debian Freedesktop

Products

Debian Linux Poppler

CVE-2022-37050

poppler: abort in PDFDoc::savePageAs in PDFDoc.c

In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Debian Freedesktop

Products

Debian Linux Poppler

CVE-2020-36024

poppler: NULL pointer dereference in `FoFiType1C::convertToType1`

An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Freedesktop Redhat

Products

Poppler Enterprise Linux