CVE-2026-93312 in Poppler
Summary
by MITRE • 09/18/2026
A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Freedesktop Poppler version 26.07.0 and prior versions centers on a critical memory safety flaw within the JBIG2 image decoding subsystem. Specifically, the defect resides in the rewind function of the JBIG2Stream class located in the source file poppler/JBJB2Stream.cc. This component is responsible for handling Joint Bi-level Image Experts Group 2 compressed images, a format commonly used in PDF documents to reduce file size while maintaining high-quality grayscale or bi-tonal imagery. The flaw manifests as a null pointer dereference, which occurs when the application attempts to access memory through a pointer that has not been properly initialized or has become invalid due to logical errors during stream processing. This type of error is particularly dangerous because it can lead to immediate application crashes and potentially allow for arbitrary code execution if an attacker can control the state of the memory at the time of dereference, although in this specific instance, the primary impact observed is denial of service through segmentation faults.
From a technical perspective, the null pointer dereference indicates that the rewind operation fails to validate whether certain internal data structures or pointers are valid before attempting to manipulate them. In C++ applications like Poppler, such errors often arise when error handling paths do not properly reset state variables or when boundary conditions in stream parsing logic leave pointers in an undefined state. When a maliciously crafted PDF document containing a malformed JBIG2 stream is processed, the parser may enter a state where expected buffers are null. The subsequent call to rewind triggers the dereference of this null pointer, causing the operating system to send a signal that terminates the process. This behavior aligns with Common Weakness Enumeration category CWE-476, which describes NULL Pointer Dereference as a software error resulting from using an uninitialized or freed memory address.
The operational impact of this vulnerability is significant for any environment relying on Poppler for document rendering services. Since PDF files are ubiquitous in enterprise workflows, email attachments, and web-based document viewers, the ability to trigger this flaw remotely makes it a high-risk issue. An attacker can distribute a specially crafted PDF file via phishing emails or malicious websites. When a victim opens the file using an application linked against the vulnerable version of Poppler, such as LibreOffice, GNOME Documents, or various command-line tools like pdftotext, the rendering engine will crash upon encountering the malformed JBIG2 stream. This results in a denial of service for the user and potentially disrupts automated document processing pipelines that depend on stable parsing behavior. The availability of public exploit code further exacerbates the risk, as it lowers the barrier to entry for attackers who may not possess advanced reverse engineering skills but can leverage existing tools to target unpatched systems.
This vulnerability is also relevant within the context of the MITRE ATT&CK framework, specifically under techniques related to Initial Exploitation and Defense Evasion through application crashes that might bypass security controls relying on process stability or trigger unexpected behavior in sandboxing environments. While primarily a denial-of-service vector due to the null pointer nature, such memory corruption issues can sometimes be chained with other vulnerabilities to achieve more severe outcomes like remote code execution if additional conditions are met during exploitation attempts. Therefore, it is treated as a critical security concern requiring immediate attention.
To mitigate this risk, organizations and individual users must upgrade Poppler to version 26.08.0 or later immediately. The patch identified by commit hash 5e49250f13b0390edeb3f90eb4c02c9941f97067 addresses the logic error within the JBIG2Stream::rewind function, ensuring that pointers are validated before use and that stream state is correctly managed during rewind operations. For system administrators managing large deployments, it is advisable to audit software dependencies for Poppler usage in document processing applications and apply updates through package managers or vendor-provided security patches as soon as they become available. Additionally, implementing input validation at the application layer where PDFs are ingested can provide an additional defense-in-depth measure by rejecting malformed streams before they reach the vulnerable parsing logic.