| عنوان | freedesktop.org Poppler 26.07.0 Integer Overflow |
|---|
| الوصف | A vulnerability was found in Poppler 26.07.0 and classified as Medium severity. Affected is the SplashClip component. The function computes size = count * 4 where count originates from PDF graphics path data controlled by the attacker. When count is a large value (e.g., 1080246813), the multiplication overflows the int type, producing undefined behavior. The overflowed size may be used for memory allocation, potentially leading to an undersized buffer allocation and subsequent heap buffer overflow. The same pattern also exists in splash/Splash.cc:6491.
Technical Details
- Affected file/function: splash/SplashClip.cc:214, SplashClip::clipToPath
- Attack vector: Local
- Privileges required: None
- User interaction required: Yes
- Trigger condition: Rendering a malformed PDF with pdftoppm
Impact
- Confidentiality: Low
- Integrity: None
- Availability: Low
CVSS v3.1
Score: 5.3 (Medium)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Timeline
- Discovered: 2026-07-20
- Vendor notified: 2026-07-20
- Patch released: Not yet fixed (still present in master 26.08.90)
- Public disclosure: 2026-07-20
Countermeasure
Do not open PDF files from untrusted sources. Process untrusted PDFs in a sandbox. Use size_t and check for overflow before multiplication. |
|---|
| المصدر | ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-SplashClip-clipToPath-SplashClip.cc-214.md |
|---|
| المستخدم | r1ck99 (UID 100733) |
|---|
| ارسال | 21/08/2026 01:39 PM (1 شهر منذ) |
|---|
| الاعتدال | 29/09/2026 04:30 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 411411 [Freedesktop Poppler حتى 26.08.0 splash/SplashClip.cc SplashClip::clipToPath تلف الذاكرة] |
|---|
| النقاط | 20 |
|---|