| Título | freedesktop.org Poppler 26.07.0 Integer Overflow |
|---|
| Descripción | A vulnerability was found in Poppler 26.07.0 and classified as Medium severity. Affected is the SplashClip component. The function computes size = count * 4 where count originates from PDF graphics path data controlled by the attacker. When count is a large value (e.g., 1080246813), the multiplication overflows the int type, producing undefined behavior. The overflowed size may be used for memory allocation, potentially leading to an undersized buffer allocation and subsequent heap buffer overflow. The same pattern also exists in splash/Splash.cc:6491.
Technical Details
- Affected file/function: splash/SplashClip.cc:214, SplashClip::clipToPath
- Attack vector: Local
- Privileges required: None
- User interaction required: Yes
- Trigger condition: Rendering a malformed PDF with pdftoppm
Impact
- Confidentiality: Low
- Integrity: None
- Availability: Low
CVSS v3.1
Score: 5.3 (Medium)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Timeline
- Discovered: 2026-07-20
- Vendor notified: 2026-07-20
- Patch released: Not yet fixed (still present in master 26.08.90)
- Public disclosure: 2026-07-20
Countermeasure
Do not open PDF files from untrusted sources. Process untrusted PDFs in a sandbox. Use size_t and check for overflow before multiplication. |
|---|
| Fuente | ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-SplashClip-clipToPath-SplashClip.cc-214.md |
|---|
| Usuario | r1ck99 (UID 100733) |
|---|
| Sumisión | 2026-08-21 13:39 (hace 1 mes) |
|---|
| Moderación | 2026-09-29 16:30 (1 month later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 411411 [Freedesktop Poppler hasta 26.08.0 splash/SplashClip.cc SplashClip::clipToPath desbordamiento de búfer] |
|---|
| Puntos | 20 |
|---|