EUVD-2026-33694
GHSA-469x-qwp6-693q
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.
AnalysisAI
Local code execution in Poppler's Splash rendering backend allows attackers to compromise applications that open attacker-supplied PDFs by triggering an integer overflow in tilingPatternFill that produces an undersized heap allocation and a subsequent out-of-bounds write. The flaw affects Poppler as shipped across Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with impact including arbitrary code execution, information disclosure, or denial of service in the rendering process. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Complete inventory of all RHEL 6-10 systems running Poppler or applications bundling Poppler; document business processes requiring PDF processing; assess external PDF sources and user opening practices. 7 days: Implement interim controls including email PDF quarantine policies, disable PDF preview features where feasible, and test business continuity impact. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Remote code execution in Hugging Face Transformers 5.2.0 allows a malicious model repository to bypass the user's explic
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission
Path traversal in Jupyter Server 2.17.0 allows authenticated users to read and write files in sibling directories outsid
Stack-based buffer overflow in rrdcached (the caching daemon for rrdtool) allows a local attacker with socket access to
Server-Side Request Forgery in Clair's fetcher component exposes internal network services and cloud metadata endpoints
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today