| 标题 | freedesktop.org Poppler 26.07.0 Integer Overflow |
|---|
| 描述 | A vulnerability was found in Poppler 26.07.0 and classified as Low severity. Affected is the FoFiTrueType component. The function uses signed int accumulators (length and checksum) that aggregate values across thousands of glyphs in a TrueType font. Since glyph lengths and checksums are read from attacker-controlled font data, large or crafted fonts cause the accumulated values to exceed INT_MAX, triggering signed integer overflow. This leads to incorrect length and checksum calculations, potentially producing corrupted TrueType-to-Type42 font conversion and malformed PostScript output.Technical Details- Affected file/function: fofi/FoFiTrueType.cc:1210, FoFiTrueType::cvtSfnts- Attack vector: Local- Privileges required: None- User interaction required: Yes- Trigger condition: Converting a PDF with a crafted TrueType font to PostScript using pdftopsImpact- Confidentiality: None- Integrity: Low- Availability: NoneCVSS v3.1Score: 3.3 (Low)Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NTimeline- Discovered: 2026-07-20- Vendor notified: 2026-07-20- Patch released: 2026-08-08 (commit 245d3c68), not yet in any release- Public disclosure: 2026-07-20CountermeasureDo not open PDF files from untrusted sources. Apply upstream fix (commit 245d3c68) or wait for next release. |
|---|
| 来源 | ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-cvtSfnts-FoFiTrueType.cc-1210.md |
|---|
| 用户 | r1ck99 (UID 100733) |
|---|
| 提交 | 2026-08-21 13時38分 (2 月前) |
|---|
| 管理 | 2026-09-29 16時30分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 411410 [Freedesktop Poppler 26.06.0/26.07.0/26.08.0 fofi/FoFiTrueType.cc FoFiTrueType::cvtSfnts 内存损坏] |
|---|
| 积分 | 20 |
|---|