Executive brief
Freedesktop Poppler is an open-source PDF rendering library used by many Linux distributions and applications to display PDF files. A malformed PDF file containing a specially crafted JBIG2 image stream can trigger an integer overflow in the PDF processing code, potentially causing the application to crash or behave unexpectedly. This could allow an attacker to disrupt service or corrupt data by distributing a malicious PDF.
Technical details
The vulnerability is a signed integer overflow in the JBIG2Stream::readCodeTableSeg() function in poppler/JBIG2Stream.cc. When processing a malformed JBIG2 image stream embedded in a PDF, the function reads a lowVal value directly from the stream data without range validation and then computes lowVal - 1. If lowVal equals INT_MIN (-2147483648), the subtraction causes a signed integer overflow, which is undefined behavior in C++. The attack requires no authentication and can be triggered remotely by a user opening a malicious PDF file with any Poppler-based application (e.g., pdfimages). The fix was committed on 2026-08-07 (commit eb87cf71) but is not yet included in any released version.
Affected products
- Freedesktop Poppler 26.07.0
Timeline
- 2026-09-18: disclosed
- 2026-08-07: patched: Fix committed as eb87cf71; not yet in released version