Executive brief
Poppler is a widely used library for rendering PDF documents in various applications and operating systems. A security flaw in its rendering engine allows a malicious PDF file to crash the application or potentially execute unauthorized code when the file is opened. This could lead to the theft of sensitive information or a complete system compromise if a user is tricked into opening a specially crafted document.
Technical details
An integer overflow vulnerability exists in Poppler's Splash backend within the `tilingPatternFill` function. The flaw is triggered during the computation of `result_width` and `result_height` when processing specific `/Matrix` and `/BBox` values for a given `/Pattern`. This overflow results in an undersized heap memory allocation via `gmallocn_checkoverflow`, leading to a heap-based buffer overflow (out-of-bounds write) in `SplashOutputDev::tilingBitmapSrc` during rendering. An attacker can exploit this by crafting a malicious PDF that, when processed by utilities like `pdftoppm` or other Poppler-based viewers, allows for arbitrary code execution, information disclosure, or a denial of service. The vulnerability was reported by Aisle Research and tracked by Red Hat.
Affected products
- freedesktop.org Poppler current
Timeline
- 2026-06-01: disclosed: CVE published and Red Hat advisory released