Executive brief
Poppler is an open-source PDF rendering library widely used by document viewers and web applications to display PDF files. A flaw in Poppler's Splash rendering backend allows an attacker to craft a malicious PDF that forces the renderer into an infinite loop when processing tiling patterns, consuming 100% CPU and rendering the application unresponsive until the process is killed or times out.
Technical details
This denial of service vulnerability exists in the SplashOutputDev::tilingPatternFill function, which fails to validate the repeat count for tiling-pattern geometry. A crafted PDF with tiling-pattern coordinates approaching the int32 boundary causes the function to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine without corresponding memory allocation. The vulnerability is triggered locally when an application using Poppler's Splash backend processes the malicious PDF file; user interaction is required to open the file. An attacker can exploit this by distributing a specially crafted PDF that consumes arbitrary CPU resources, causing a denial of service. The root cause is unchecked input for loop condition (CWE-606).
Affected products
- Poppler Poppler <UNKNOWN>
Timeline
- 2026-09-18: disclosed