| タイトル | freedesktop.org Poppler 26.07.0 Integer Overflow |
|---|
| 説明 | A vulnerability was found in Poppler 26.07.0 and classified as Medium severity. Affected is the SplashClip component. The function computes size = count * 4 where count originates from PDF graphics path data controlled by the attacker. When count is a large value (e.g., 1080246813), the multiplication overflows the int type, producing undefined behavior. The overflowed size may be used for memory allocation, potentially leading to an undersized buffer allocation and subsequent heap buffer overflow. The same pattern also exists in splash/Splash.cc:6491.
Technical Details
- Affected file/function: splash/SplashClip.cc:214, SplashClip::clipToPath
- Attack vector: Local
- Privileges required: None
- User interaction required: Yes
- Trigger condition: Rendering a malformed PDF with pdftoppm
Impact
- Confidentiality: Low
- Integrity: None
- Availability: Low
CVSS v3.1
Score: 5.3 (Medium)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Timeline
- Discovered: 2026-07-20
- Vendor notified: 2026-07-20
- Patch released: Not yet fixed (still present in master 26.08.90)
- Public disclosure: 2026-07-20
Countermeasure
Do not open PDF files from untrusted sources. Process untrusted PDFs in a sandbox. Use size_t and check for overflow before multiplication. |
|---|
| ソース | ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-SplashClip-clipToPath-SplashClip.cc-214.md |
|---|
| ユーザー | r1ck99 (UID 100733) |
|---|
| 送信 | 2026年08月21日 13:39 (1 月 ago) |
|---|
| モデレーション | 2026年09月29日 16:30 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 411411 [Freedesktop Poppler 迄 26.08.0 splash/SplashClip.cc SplashClip::clipToPath メモリ破損] |
|---|
| ポイント | 20 |
|---|