| Title | freedesktop.org Poppler 26.07.0 Integer Overflow |
|---|
| Description | A vulnerability was found in Poppler 26.07.0 and classified as Medium severity. Affected is the FoFiTrueType component. The function FoFiTrueType::mapCodeToGID assigns the attacker-controlled segCnt value (32-bit unsigned, greater than INT_MAX) to a signed int variable b, causing integer wraparound to a negative value. The existing check if (b > INT_MAX/12) only checks positive bounds and cannot catch the negative wrapped value. The subsequent multiplication 12 * b overflows the int type, causing incorrect offset calculation and potential out-of-bounds memory access via getU32BE().
Technical Details
- Affected file/function: fofi/FoFiTrueType.cc:608, FoFiTrueType::mapCodeToGID
- Attack vector: Local
- Privileges required: None
- User interaction required: Yes
- Trigger condition: Processing a PDF with a malicious TrueType font using pdftoppm
Impact
- Confidentiality: Low
- Integrity: None
- Availability: Low
CVSS v3.1
Score: 5.3 (Medium)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Timeline
- Discovered: 2026-07-20
- Vendor notified: 2026-07-20
- Patch released: 2026-07-26 (commit ed2a5538, first in release 26.08.0)
- Public disclosure: 2026-07-26
Countermeasure
Upgrade to Poppler 26.08.0 or later. The fix uses checkedMultiply to prevent the integer overflow in the segCnt assignment and subsequent multiplication.
Proof of Concept (UBSan output)
FoFiTrueType.cc:608:41: runtime error: signed integer overflow: -1342177248 * 12 cannot be represented in type 'int'
#0 FoFiTrueType::mapCodeToGID(int, unsigned int) const FoFiTrueType.cc:608
#1 Gfx8BitFont::getCodeToGIDMap(FoFiTrueType*) GfxFont.cc:1642
#2 SplashOutputDev::doUpdateFont(GfxState*) SplashOutputDev.cc:1902
#3 SplashOutputDev::drawChar(...) SplashOutputDev.cc:2135
#4 Gfx::doShowText(...) Gfx.cc:4051
#5 Gfx::opShowText(Object*, int) Gfx.cc:3779
#6 Gfx::execOp(Object*, Object*, int) Gfx.cc:786
#7 Gfx::go(Gfx::DisplayType) Gfx.cc:657
#8 Gfx::display(Object*, Gfx::DisplayType) Gfx.cc:614
#9 Page::displaySlice(...) Page.cc:616
#10 PDFDoc::displayPageSlice(...) PDFDoc.cc:632
#11 savePageSlice utils/pdftoppm.cc:292
#12 main utils/pdftoppm.cc:693
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior FoFiTrueType.cc:608:41 |
|---|
| Source | ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-mapCodeToGID-FoFiTrueType.cc-608.md |
|---|
| User | r1ck99 (UID 100733) |
|---|
| Submission | 08/21/2026 13:37 (28 days ago) |
|---|
| Moderation | 09/17/2026 19:13 (27 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 406613 [Freedesktop Poppler 26.07.0 fofi/FoFiTrueType.cc mapCodeToGID segCnt integer overflow] |
|---|
| Points | 20 |
|---|