CVE-2026-93314 in Poppler
Summary
by MITRE • 09/18/2026
A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The Freedesktop Poppler library, specifically version 26.07.0 and potentially earlier versions, contains a critical security flaw within the TrueType font parsing component. This vulnerability resides in the FoFiTrueType::mapCodeToGID function located in the source file fofi/FoFiTrueType.cc. The core technical issue is an integer overflow that occurs during the processing of specific arguments related to glyph mapping. When the library processes a maliciously crafted TrueType font, it fails to properly validate or handle arithmetic operations involving segment counts and code-to-glyph ID mappings. This lack of rigorous bounds checking allows for an integer overflow condition, which can lead to out-of-bounds memory access or other undefined behaviors depending on how the resulting corrupted value is utilized by subsequent parsing logic.
From a technical perspective, this vulnerability aligns with CWE-190 (Integer Overflow or Wraparound) and potentially CWE-787 (Out-of-Bounds Write) if the overflow leads to writing data beyond allocated memory buffers. The FoFiTrueType module is responsible for interpreting TrueType font structures, which are commonly embedded in PDF documents or processed as standalone font files. Because Poppler is widely used by various applications such as document viewers and web browsers to render text content, an attacker can exploit this flaw remotely by embedding a specially crafted malicious font within a PDF file or delivering it through other supported formats that trigger the parsing routine. The remote nature of the attack vector means that no user interaction beyond opening the document is required for exploitation in many scenarios.
The operational impact of this vulnerability is severe, as successful exploitation can lead to arbitrary code execution on the victim's system. By controlling the memory layout and leveraging the integer overflow, an attacker may achieve control over program flow or corrupt critical data structures within the application process. This could result in a complete compromise of the host machine, including theft of sensitive information, installation of malware, or use as part of a botnet. The fact that this exploit has been publicly disclosed significantly increases the risk landscape, as threat actors can readily develop and deploy weaponized payloads against unpatched systems. Organizations relying on Poppler for document processing are therefore at immediate risk if they have not applied corrective measures.
To mitigate this vulnerability, it is imperative to update the Freedesktop Poppler library to a version that includes the patch identified by commit hash ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. This patch addresses the integer overflow issue within the mapCodeToGID function, ensuring proper validation of segment counts and safe handling of glyph mapping operations. Administrators should verify that all dependent applications are linked against the patched library version. Additionally, implementing defense-in-depth strategies such as sandboxing document viewers, enabling memory protection mechanisms like ASLR and DEP, and restricting font parsing capabilities to trusted sources can further reduce the attack surface. Regular monitoring for vendor security advisories is recommended to stay ahead of emerging threats in widely used open-source components.