Executive brief
Poppler is a widely-used PDF rendering library that converts PDF documents into images and other formats. A flaw in its TrueType font parsing can be triggered by a specially crafted PDF containing a malformed font, causing an integer overflow that may lead to reading memory outside intended bounds. An attacker could exploit this via a malicious PDF file to crash the application or potentially access sensitive data from memory.
Technical details
This vulnerability is a signed integer overflow in the FoFiTrueType::mapCodeToGID() function (fofi/FoFiTrueType.cc:608) triggered by manipulation of the segCnt parameter read from a TrueType cmap table within a PDF. An attacker provides a malformed TrueType font embedded in a PDF; when the library reads a segCnt value larger than INT_MAX, the assignment to a signed int variable wraps to a negative value. The existing overflow guard only checks the positive bound and fails to catch the wrapped negative, allowing a subsequent multiplication (12 * b) to overflow and produce an incorrect memory offset. This leads to an out-of-bounds read in getU32BE(). The vulnerability requires a network-accessible PDF rendering service or local PDF processing; it was publicly disclosed and a patch (commit ed2a5538) was released in Poppler 26.08.0.
Affected products
- Freedesktop Poppler 26.07.0
Timeline
- 2026-07-20: disclosed: Vulnerability discovered
- 2026-07-26: patched: Fix committed as ed2a5538, released in Poppler 26.08.0