CVE-2026-93311 in Poppler
Summary
by MITRE • 09/18/2026
A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The Freedesktop Poppler library, specifically version 26.07.0, contains a critical integer overflow vulnerability within its PDF rendering engine that poses significant risks to applications relying on this component for document processing. The flaw is located in the SampledFunction::SampledFunction constructor found in the poppler/Function.cc source file. This function handles sampled functions used extensively in PDF files to define color spaces, gradients, and other graphical elements through mathematical sampling. When parsing these structures, the library processes an argument labeled BitsPerSample which dictates the number of bits allocated for each sample value within a data stream. The vulnerability arises from insufficient validation or arithmetic handling when this parameter is manipulated by a maliciously crafted PDF document.
The technical nature of this flaw constitutes an integer overflow as defined under CWE-190, where an arithmetic operation produces a result that exceeds the maximum capacity of the allocated numeric type. In the context of Poppler's C++ implementation, improper handling of the BitsPerSample value can lead to incorrect calculations regarding buffer sizes or array indices during memory allocation and data copying operations. If an attacker provides a specially crafted PDF with a malformed BitsPerSample field, the resulting integer overflow may cause the application to allocate insufficient memory or write beyond allocated boundaries. This scenario creates conditions ripe for heap-based buffer overflows, which are particularly dangerous as they allow attackers to corrupt adjacent memory structures within the process space of the vulnerable application.
The operational impact of this vulnerability is severe due to its remote exploitability and the widespread adoption of Poppler in various software ecosystems including web browsers like Firefox and Chromium, document viewers such as Evince, and backend services that parse PDF content for security scanning or text extraction. Since the attack vector is remote, an attacker does not need physical access or user interaction beyond opening a malicious file or loading a compromised webpage containing embedded PDFs. The fact that public exploits are available significantly lowers the barrier to entry for threat actors, enabling widespread automated attacks against unpatched systems. Successful exploitation could lead to arbitrary code execution with the privileges of the affected application, potentially resulting in full system compromise, data exfiltration, or denial of service conditions through application crashes.
From a defensive posture perspective, this vulnerability aligns with MITRE ATT&CK techniques related to initial access and privilege escalation via client-side attacks. Organizations utilizing Poppler should prioritize immediate mitigation strategies given the public availability of exploits. The most effective remediation is upgrading to a patched version of Freedesktop Poppler where the integer overflow in SampledFunction has been addressed through rigorous input validation and safe arithmetic practices. In environments where an upgrade is not immediately feasible, deploying web application firewalls or PDF sanitization tools that strip or validate suspicious metadata before rendering can provide temporary protection. Additionally, enabling sandboxing mechanisms for applications that process untrusted PDF content can limit the blast radius of any successful exploitation attempt by restricting access to critical system resources and memory regions.