Executive brief
Poppler is a widely-used PDF rendering library used by many Linux applications and web services to display PDF documents. A malformed PDF file can trigger an integer overflow in Poppler's PDF function parser, causing the application to crash when processing the file. An attacker could distribute a specially crafted PDF to cause denial of service in any system using Poppler to process PDFs.
Technical details
The vulnerability is a shift-exponent undefined behavior (C++ UB) in SampledFunction::SampledFunction at poppler/Function.cc:376. The root cause is insufficient validation of the BitsPerSample parameter read from a PDF Type 4 sampled function stream. When BitsPerSample is 32 or greater, the shift operation `bitMask = (1 << sampleBits) - 1` triggers undefined behavior because the shift exponent exceeds the bit width of the 32-bit integer type. The attack vector is remote: a specially crafted PDF file processed by any Poppler-based tool (pdfimages, PDF viewers, web services) causes a crash. User interaction is required (opening/processing the malicious PDF). The impact is denial of service via application crash; no code execution or data exposure is possible.
Affected products
- Freedesktop Poppler 26.07.0 and earlier
Timeline
- 2026-09-18: disclosed: CVE-2026-93311 published on NVD
- 2026-07-20: other: Vulnerability discovered by r1ck9
- 2026-09-18: other: Exploit made public; proof-of-concept PDF available