| Titre | freedesktop.org Poppler 26.07.0 NULL Pointer Dereference |
|---|
| Description | A vulnerability was found in Poppler 26.07.0 and classified as Low. Affected is the JBIG2Stream component. The manipulation of a JBIG2 image stream leads to null pointer offset undefined behavior. When pageBitmap is non-null but getDataPtr() returns null due to allocation failure, the expression dataPtr + pageBitmap->getDataSize() applies a non-zero offset (32511) to a null pointer, triggering undefined behavior.
Technical Details
- Affected file/function: poppler/JBIG2Stream.cc:1229, JBIG2Stream::rewind
- Attack vector: Local
- Privileges required: None
- User interaction required: Yes
- Trigger condition: Opening a malicious PDF containing a JBIG2 image stream with allocation failure in bitmap data
Proof of Concept (UBSan output):
/home/ricky_1208/poppler_src/poppler/JBIG2Stream.cc:1229:27: runtime error: applying non-zero offset 32511 to null pointer
#0 0x5de631339deb in JBIG2Stream::rewind() /home/ricky_1208/poppler_src/poppler/JBIG2Stream.cc:1229:27
#1 0x5de6310ff2c6 in Lexer::Lexer(XRef*, Object*) /home/ricky_1208/poppler_src/poppler/Lexer.cc:101:39
#2 0x5de63111b9e7 in Parser::Parser(XRef*, Object*, bool) /home/ricky_1208/poppler_src/poppler/Parser.cc:59:68
#3 0x5de6311a5fec in XRef::constructObjectStreamEntries(Object*, int) /home/ricky_1208/poppler_src/poppler/XRef.cc:1138:12
#4 0x5de6311a1fc0 in XRef::constructXRef(bool*, bool) /home/ricky_1208/poppler_src/poppler/XRef.cc:1014:17
#5 0x5de6311a13a6 in XRef::XRef(BaseStream*, long long, long long, bool*, bool, std::function<void ()> const&) /home/ricky_1208/poppler_src/poppler/XRef.cc:305:20
#6 0x5de63111e6e4 in PDFDoc::setup(...) /home/ricky_1208/poppler_src/poppler/PDFDoc.cc:253:16
#7 0x5de63111e3c6 in PDFDoc::PDFDoc(...) /home/ricky_1208/poppler_src/poppler/PDFDoc.cc:167:10
#8 0x5de6313645fd in LocalPDFDocBuilder::buildPDFDoc(...) /home/ricky_1208/poppler_src/poppler/LocalPDFDocBuilder.cc
#9 0x5de6313645fd in std::__detail::_MakeUniq<PDFDoc>::__single_object std::make_unique<PDFDoc, ...>(...) /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/unique_ptr.h:1070:34
#10 0x5de63114ee73 in PDFDocFactory::createPDFDoc(...) /home/ricky_1208/poppler_src/poppler/PDFDocFactory.cc:63:29
#11 0x5de630f6fa56 in main /home/ricky_1208/poppler_src/utils/pdfinfo.cc:1021:27
#12 0x77926aa2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58:16
#13 0x77926aa2a28a in __libc_start_main_impl ../csu/libc-start.c:360:3
#14 0x5de630f42d44 in _start (/home/ricky_1208/poppler_src/build_clang/utils/pdfinfo+0x31fd44)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/ricky_1208/poppler_src/poppler/JBIG2Stream.cc:1229:27
Impact
- Confidentiality: None
- Integrity: None
- Availability: Low
CVSS v3.1
Score: 3.3 (Low)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Timeline
- Discovered: 2026-07-20
- Vendor notified: 2026-07-20
- Patch released: 2026-07-26 (commit 5e49250f), first in 26.08.0
- Public disclosure: 2026-08-21
Countermeasure
Upgrade to Poppler 26.08.0 or later. The fix adds an isOk() check before accessing bitmap data. |
|---|
| La source | ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Null-pointer-offset-undefined-behavior-in-JBIG2Stream-rewind-JBIG2Stream.cc-1229.md |
|---|
| Utilisateur | r1ck99 (UID 100733) |
|---|
| Soumission | 21/08/2026 13:35 (il y a 28 jours) |
|---|
| Modérer | 17/09/2026 19:13 (27 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 406610 [Freedesktop Poppler 26.07.0 poppler/JBIG2Stream.cc JBIG2Stream::rewind déni de service] |
|---|
| Points | 20 |
|---|