| Titolo | freedesktop.org Poppler 26.07.0 Integer Overflow |
|---|
| Descrizione | A vulnerability was found in Poppler 26.07.0 and classified as Medium severity. Affected is the JBIG2Stream component. The function JBIG2Stream::readCodeTableSeg reads lowVal directly from JBIG2 segment data without range validation. When lowVal equals INT_MIN (-2147483648), the subtraction lowVal - 1 overflows the int type, which is undefined behavior in C++. The overflowed value is written into the Huffman decode table, potentially causing memory corruption during subsequent JBIG2 decoding.
Technical Details
- Affected file/function: poppler/JBIG2Stream.cc:4118, JBIG2Stream::readCodeTableSeg
- Attack vector: Local
- Privileges required: None
- User interaction required: Yes
- Trigger condition: Processing a malformed PDF with a JBIG2 image stream using pdfimages -list
Impact
- Confidentiality: Low
- Integrity: Low
- Availability: Low
CVSS v3.1
Score: 5.3 (Medium)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Timeline
- Discovered: 2026-07-20
- Vendor notified: 2026-07-20
- Patch released: 2026-08-07 (commit eb87cf71, not yet in any release)
- Public disclosure: 2026-08-07
Countermeasure
Do not open PDF files from untrusted sources. Apply upstream fix (commit eb87cf71) or wait for the next release that includes the patch.
Proof of Concept (UBSan output)
JBIG2Stream.cc:4118:29: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
#0 JBIG2Stream::readCodeTableSeg(unsigned int) JBIG2Stream.cc:4118
#1 JBIG2Stream::readSegments() JBIG2Stream.cc:1470
#2 JBIG2Stream::rewind() JBIG2Stream.cc:1225
#3 Lexer::Lexer(XRef*, Object*) Lexer.cc:101
#4 Parser::Parser(XRef*, Object*, bool) Parser.cc:59
#5 Gfx::display(Object*, Gfx::DisplayType) Gfx.cc:613
#6 Page::displaySlice(...) Page.cc:616
#7 Page::display(...) Page.cc:568
#8 PDFDoc::displayPage(...) PDFDoc.cc:614
#9 PDFDoc::displayPages(...) PDFDoc.cc:624
#10 main utils/pdfimages.cc:187
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior JBIG2Stream.cc:4118:29 |
|---|
| Fonte | ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-JBIG2Stream-readCodeTableSeg-JBIG2Stream.cc-4118.md |
|---|
| Utente | r1ck99 (UID 100733) |
|---|
| Sottomissione | 21/08/2026 13:36 (28 giorni fa) |
|---|
| Moderazione | 17/09/2026 19:13 (27 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 406612 [Freedesktop Poppler 26.07.0 poppler/JBIG2Stream.cc readCodeTableSeg buffer overflow] |
|---|
| Punti | 20 |
|---|