| タイトル | freedesktop.org Poppler 26.07.0 Integer Overflow |
|---|
| 説明 | A vulnerability was found in Poppler 26.07.0 and classified as Low severity. Affected is the FoFiTrueType component. The function uses signed int accumulators (length and checksum) that aggregate values across thousands of glyphs in a TrueType font. Since glyph lengths and checksums are read from attacker-controlled font data, large or crafted fonts cause the accumulated values to exceed INT_MAX, triggering signed integer overflow. This leads to incorrect length and checksum calculations, potentially producing corrupted TrueType-to-Type42 font conversion and malformed PostScript output.Technical Details- Affected file/function: fofi/FoFiTrueType.cc:1210, FoFiTrueType::cvtSfnts- Attack vector: Local- Privileges required: None- User interaction required: Yes- Trigger condition: Converting a PDF with a crafted TrueType font to PostScript using pdftopsImpact- Confidentiality: None- Integrity: Low- Availability: NoneCVSS v3.1Score: 3.3 (Low)Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NTimeline- Discovered: 2026-07-20- Vendor notified: 2026-07-20- Patch released: 2026-08-08 (commit 245d3c68), not yet in any release- Public disclosure: 2026-07-20CountermeasureDo not open PDF files from untrusted sources. Apply upstream fix (commit 245d3c68) or wait for next release. |
|---|
| ソース | ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-cvtSfnts-FoFiTrueType.cc-1210.md |
|---|
| ユーザー | r1ck99 (UID 100733) |
|---|
| 送信 | 2026年08月21日 13:38 (2 月 ago) |
|---|
| モデレーション | 2026年09月29日 16:30 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 411410 [Freedesktop Poppler 26.06.0/26.07.0/26.08.0 fofi/FoFiTrueType.cc FoFiTrueType::cvtSfnts メモリ破損] |
|---|
| ポイント | 20 |
|---|