Submit #942344: freedesktop.org Poppler 26.07.0 Integer Overflow

A vulnerability was found in Poppler 26.07.0 and classified as Low. Affected is the SampledFunction component. The manipulation of the BitsPerSample value in a PDF Type 0 sampled function leads to shift exponent undefined behavior. When BitsPerSample is set to 32 or greater, the expression (1 << sampleBits) - 1 triggers undefined behavior on 32-bit int type.

Technical Details
- Affected file/function: poppler/Function.cc:376, SampledFunction::SampledFunction
- Attack vector: Local
- Privileges required: None
- User interaction required: Yes
- Trigger condition: Opening a malicious PDF containing a Type 0 sampled function with BitsPerSample >= 32

Proof of Concept (UBSan output):

/home/ricky_1208/poppler_src/poppler/Function.cc:376:18: runtime error: shift exponent 32 is too large for 32-bit type 'int'
#0 0x5b920d43993c in SampledFunction::SampledFunction(Object*, Dict*) /home/ricky_1208/poppler_src/poppler/Function.cc:376
#1 0x5b920d43ef9a in Function::parse(Object*, RefRecursionChecker&) /home/ricky_1208/poppler_src/poppler/Function.cc:87
#2 0x5b920d43f368 in Function::parse(Object*) /home/ricky_1208/poppler_src/poppler/Function.cc:60
#3 0x5b920d19d1f1 in GfxFunctionShading::parse(...) /home/ricky_1208/poppler_src/poppler/GfxState.cc:3571
#4 0x5b920d1ae8e4 in GfxShading::parse(...) /home/ricky_1208/poppler_src/poppler/GfxState.cc:3390
#5 0x5b920d1af06b in GfxShadingPattern::parse(...) /home/ricky_1208/poppler_src/poppler/GfxState.cc:3303
#6 0x5b920d1afb3b in GfxPattern::parse(...) /home/ricky_1208/poppler_src/poppler/GfxState.cc:3177
#7 0x5b920d45e1a6 in GfxResources::lookupPattern(...) /home/ricky_1208/poppler_src/poppler/Gfx.cc:387
#8 0x5b920d467f64 in Gfx::opSetStrokeColorN(Object*, int) /home/ricky_1208/poppler_src/poppler/Gfx.cc:1642
#9 0x5b920d44986e in Gfx::execOp(Object*, Object*, int) /home/ricky_1208/poppler_src/poppler/Gfx.cc:786
#10 0x5b920d478c42 in Gfx::go(Gfx::DisplayType) /home/ricky_1208/poppler_src/poppler/Gfx.cc:657
#11 0x5b920d47ae95 in Gfx::display(Object*, Gfx::DisplayType) /home/ricky_1208/poppler_src/poppler/Gfx.cc:614
#12 0x5b920d4fb1e1 in Page::displaySlice(...) /home/ricky_1208/poppler_src/poppler/Page.cc:616
#13 0x5b920d4fb8fd in Page::display(...) /home/ricky_1208/poppler_src/poppler/Page.cc:568
#14 0x5b920d21f5df in PDFDoc::displayPage(...) /home/ricky_1208/poppler_src/poppler/PDFDoc.cc:614
#15 0x5b920d21f811 in PDFDoc::displayPages(...) /home/ricky_1208/poppler_src/poppler/PDFDoc.cc:624
#16 0x5b920d15a3f9 in main /home/ricky_1208/poppler_src/utils/pdfimages.cc:187
#17 0x7a370f42a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#18 0x7a370f42a28a in __libc_start_main_impl ../csu/libc-start.c:360
#19 0x5b920d157074 in _start (/home/ricky_1208/poppler_src/build/utils/pdfimages+0x4ce074)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/ricky_1208/poppler_src/poppler/Function.cc:376:18

Impact
- Confidentiality: None
- Integrity: None
- Availability: Low

CVSS v3.1
Score: 3.3 (Low)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Timeline
- Discovered: 2026-07-20
- Vendor notified: 2026-07-20
- Patch released: Not yet fixed (still present in master 26.08.90)
- Public disclosure: 2026-08-21

Countermeasure
Do not open PDF files from untrusted sources. Process untrusted PDFs in a sandbox. Validate BitsPerSample before shift operation.

• Source: ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Shift-exponent-undefined-behavior-in-SampledFunction-Function.cc-376.md
• User: r1ck99 (UID 100733)
• Submission: 08/21/2026 13:30 (27 days ago)
• Moderation: 09/17/2026 19:13 (27 days later)
• Status: Accepted
• VulDB entry: 406609 [Freedesktop Poppler 26.07.0 SampledFunction poppler/Function.cc BitsPerSample integer overflow]
• Points: 20