| Title | freedesktop.org Poppler 26.07.0 Integer Overflow |
|---|
| Description | A vulnerability was found in Poppler 26.07.0 and classified as Low severity. Affected is the FoFiTrueType component. The function uses signed int accumulators (length and checksum) that aggregate values across thousands of glyphs in a TrueType font. Since glyph lengths and checksums are read from attacker-controlled font data, large or crafted fonts cause the accumulated values to exceed INT_MAX, triggering signed integer overflow. This leads to incorrect length and checksum calculations, potentially producing corrupted TrueType-to-Type42 font conversion and malformed PostScript output.Technical Details- Affected file/function: fofi/FoFiTrueType.cc:1210, FoFiTrueType::cvtSfnts- Attack vector: Local- Privileges required: None- User interaction required: Yes- Trigger condition: Converting a PDF with a crafted TrueType font to PostScript using pdftopsImpact- Confidentiality: None- Integrity: Low- Availability: NoneCVSS v3.1Score: 3.3 (Low)Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NTimeline- Discovered: 2026-07-20- Vendor notified: 2026-07-20- Patch released: 2026-08-08 (commit 245d3c68), not yet in any release- Public disclosure: 2026-07-20CountermeasureDo not open PDF files from untrusted sources. Apply upstream fix (commit 245d3c68) or wait for next release. |
|---|
| Source | ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-cvtSfnts-FoFiTrueType.cc-1210.md |
|---|
| User | r1ck99 (UID 100733) |
|---|
| Submission | 08/21/2026 13:38 (2 months ago) |
|---|
| Moderation | 09/29/2026 16:30 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 411410 [Freedesktop Poppler 26.06.0/26.07.0/26.08.0 fofi/FoFiTrueType.cc FoFiTrueType::cvtSfnts integer overflow] |
|---|
| Points | 20 |
|---|