Read the docs
TI-2026-69737 Aliases CVE-2026-107705

Stack buffer overflow in Poppler PDF password handling

Priority LOW 36CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Poppler from 0.42.0 through 26.10.0 contains a stack-based buffer overflow (CWE-121) in Decrypt::revision6Hash() when opening AESV3/R6 encrypted PDFs. An attacker who controls the password, supplied through applications using the libpoppler, libpoppler-glib or C++ API, can send a password longer than 127 bytes to overwrite stack memory. The attack needs no privileges or user interaction and can crash the process or corrupt memory.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00324 25th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Freedesktoppoppler0.42.0 – 26.10.0—No fix listedCNA
  • poppler VendorFreedesktop Affected 0.42.0 – 26.10.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:*——Freedesktop
  • cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:* Versions — — ·Freedesktop

Remediation

The sources list no fixed version for Poppler. Red Hat fixes Red Hat Hardened Images with RHSA-2026:80172 and RHSA-2026:80579. Red Hat lists no available fix plan for Red Hat Enterprise Linux 8, 9 and 10.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Red Hat 2 advisories

  • RHSA-2026:80579 Released 2026-10-12 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images poppler-26.08.0-1.4.hum1@aarch64, poppler-26.08.0-1.4.hum1@s390x, poppler-26.08.0-1.4.hum1@src +28
  • RHSA-2026:80172 Released 2026-10-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images poppler-26.08.0-1.3.hum1@aarch64, poppler-26.08.0-1.3.hum1@src, poppler-26.08.0-1.3.hum1@x86_64 +19

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:80172, RHSA-2026:80579
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107705
  2. 2026-10-10 Fix available: RHSA-2026:80172 · Red Hat
  3. 2026-10-10 Fix available: Red Hat Hardened Images · Red Hat
  4. 2026-10-10 Priority changed: MEDIUM → LOW
  5. 2026-10-13 Fix available: RHSA-2026:80579 · Red Hat
  6. 2026-10-13 Affected versions changed · Red Hat
  7. 2026-10-15 CISA SSVC decision points changed

References

Patch 1

Other 3

  • TI-2021-11232 Integer overflow in Apple macOS KEVCVSS 3.1HIGH 7.8
  • TI-2026-37034 In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys… CVSS 3.1CRITICAL 9.8
  • TI-2022-03721 When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the… CVSS 3.1HIGH 7.4
  • TI-2026-62922 Freedesktop Poppler SampledFunction Function.cc integer overflow CVSS 4.0MEDIUM 5.3
  • TI-2025-32126 An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to… CVSS 3.1MEDIUM 6.5
  • TI-2022-20347 An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and… CVSS 3.1MEDIUM 6.5
See all 158 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences