| Название | freedesktop.org Poppler 26.07.0 Integer Overflow |
|---|
| Описание | A vulnerability was found in Poppler 26.07.0 and classified as Low severity. Affected is the FoFiTrueType component. The function uses signed int accumulators (length and checksum) that aggregate values across thousands of glyphs in a TrueType font. Since glyph lengths and checksums are read from attacker-controlled font data, large or crafted fonts cause the accumulated values to exceed INT_MAX, triggering signed integer overflow. This leads to incorrect length and checksum calculations, potentially producing corrupted TrueType-to-Type42 font conversion and malformed PostScript output.Technical Details- Affected file/function: fofi/FoFiTrueType.cc:1210, FoFiTrueType::cvtSfnts- Attack vector: Local- Privileges required: None- User interaction required: Yes- Trigger condition: Converting a PDF with a crafted TrueType font to PostScript using pdftopsImpact- Confidentiality: None- Integrity: Low- Availability: NoneCVSS v3.1Score: 3.3 (Low)Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NTimeline- Discovered: 2026-07-20- Vendor notified: 2026-07-20- Patch released: 2026-08-08 (commit 245d3c68), not yet in any release- Public disclosure: 2026-07-20CountermeasureDo not open PDF files from untrusted sources. Apply upstream fix (commit 245d3c68) or wait for next release. |
|---|
| Источник | ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-cvtSfnts-FoFiTrueType.cc-1210.md |
|---|
| Пользователь | r1ck99 (UID 100733) |
|---|
| Представление | 21.08.2026 13:38 (2 месяцы назад) |
|---|
| Модерация | 29.09.2026 16:30 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 411410 [Freedesktop Poppler 26.06.0/26.07.0/26.08.0 fofi/FoFiTrueType.cc FoFiTrueType::cvtSfnts повреждение памяти] |
|---|
| Баллы | 20 |
|---|