Executive brief
Poppler is an open-source PDF rendering library used by many applications to display and process PDF documents. A flaw in version 26.07.0 can cause a crash when processing malformed PDF files containing JBIG2 image streams, potentially denying service to users attempting to open such documents. An attacker could distribute a specially crafted PDF to trigger this crash.
Technical details
The vulnerability is a null pointer offset undefined behavior in the JBIG2Stream::rewind() function (poppler/JBIG2Stream.cc:1229). The root cause occurs when pageBitmap is non-null but getDataPtr() returns null—an arithmetic offset is then applied to the null pointer, violating C++ undefined behavior rules. The attack vector is remote (malformed PDF processing) with no authentication required; a user must attempt to open or process a crafted PDF file. The impact is denial of service via application crash. The vulnerability was fixed in version 26.08.0 (commit 5e49250f) with a proper null pointer check before offset calculation.
Affected products
- Freedesktop Poppler 26.07.0
Timeline
- 2026-09-18: disclosed: Vulnerability published
- 2026-07-26: patched: Fix committed as 5e49250f, first released in version 26.08.0
- 2026-07-20: other: Vulnerability discovered