EUVD-2026-33694
GHSA-469x-qwp6-693q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft PDF with malicious tiling pattern
-
DeliveryDeliver via email or web download
-
ExploitVictim opens in Poppler-based viewer
-
InstallInteger overflow in tilingPatternFill
-
C2Undersized heap allocation receives out-of-bounds write
-
ExecuteHijack control flow in renderer process
-
ImpactExecute code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim or an automated pipeline to render an attacker-supplied PDF using Poppler's Splash backend (the default software rasterizer used by Evince, Okular, poppler-utils such as pdftoppm/pdftocairo, and many server-side document converters and thumbnailers). The PDF must contain a tiling pattern fill object with crafted dimensions that overflow the size arithmetic in tilingPatternFill. The CVSS vector requires user interaction (UI:R), meaning a user must open the document or an automated service must process it; no authentication is required of the attacker (PR:N), and exploitation occurs locally (AV:L) in the context of whichever process invokes the Splash renderer. Limiting factors: alternative Poppler backends (Cairo, splash-disabled builds), sandboxed renderers (browser PDF viewers, Flatpak/snap confinement), and disabled auto-thumbnailing all reduce realistic exposure. No special non-default configuration is needed beyond using Poppler's standard Splash rendering path. |
| Impact | The CVSS 7.8 score reflects local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), and required user interaction (UI:R) with high impact across confidentiality, integrity, and availability - a profile consistent with a client-side document-parsing bug where the 'local' vector is realized whenever a user opens a hostile PDF delivered via phishing, web download, or shared file. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so this is not a drop-everything emergency; however, Poppler's ubiquity across Linux desktops and server-side PDF pipelines (thumbnailers, mail gateways, document converters) means heap-corruption bugs here have historically been weaponized once a working exploit lands. The fact that Red Hat is tracking it across every supported RHEL major version including the legacy ELS streams (6, 7) suggests the vulnerable code path is long-lived; defenders should treat this as a standard urgent client-side patch priority rather than a zero-day. Key data gap: no fix version or patched build is referenced in the available data, only the upstream tracker. |
| Exploit ScenarioDerived | An attacker crafts a malicious PDF containing a tiling pattern whose dimensions trigger integer overflow in tilingPatternFill and emails it to a target or hosts it on a watering-hole site. When the victim opens the PDF in Evince/Okular, or a server-side service auto-renders it for thumbnailing or conversion, the undersized heap allocation is overflowed, giving the attacker arbitrary code execution in the context of the rendering process - typically the user's desktop session or an unprivileged service account. No public proof-of-concept is currently identified, but the bug class is well-understood and prior Poppler heap bugs have been exploited within weeks of disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 01, 2026
Local code execution in Poppler's Splash rendering backend allows attackers to compromise applications that open attacker-supplied PDFs by triggering an integer overflow in tilingPatternFill that produces an undersized heap allocation and a subsequent out-of-bounds write. The flaw affects Poppler as shipped across Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with impact including arbitrary code execution, information disclosure, or denial of service in the rendering process. No public exploit identified at time of analysis, and the CVSS 7.8 vector requires user interaction to open a malicious PDF.
RemediationAI
No vendor-released patch identified at time of analysis; the upstream fix is being coordinated in the Poppler GitLab work item 1715 and Red Hat is tracking per-RHEL erratum in Bugzilla 2460428, so monitor access.redhat.com/security/cve/CVE-2026-10118 and apply the poppler package updates for your RHEL major version as soon as errata ship via yum/dnf update poppler poppler-glib poppler-utils followed by restarting any long-running document viewers or conversion services. As compensating controls until a patched build is available, restrict opening of untrusted PDFs (train users to avoid email attachments and unknown downloads), disable automatic PDF thumbnailing in file managers (gsettings org.gnome.nautilus.preferences show-image-thumbnails 'never' and equivalent for KDE, at the cost of losing previews), route server-side PDF processing through sandboxed containers or seccomp/bubblewrap-confined workers to contain a successful heap corruption, and consider switching desktop users to a non-Splash renderer or a sandboxed alternative such as a browser's built-in PDF viewer for untrusted documents (trade-off: feature parity and rendering fidelity).
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Poppler is a widely embedded PDF rendering library derived from Xpdf and used by desktop viewers (Evince, Okular), thumbnailers, file managers, and server-side document converters across Linux distributions. The Splash backend is Poppler's software rasterizer; the tilingPatternFill function implements PDF tiling pattern fills, which repeat a small pattern cell across a region. The root cause is CWE-190 (Integer Overflow or Wraparound): arithmetic on pattern dimensions wraps to a small value, leading to an undersized heap buffer being allocated while subsequent rasterization writes the full uncapped extent, producing a heap out-of-bounds write that can corrupt adjacent allocator metadata or object pointers and ultimately steer execution. The upstream issue is tracked at gitlab.freedesktop.org/poppler/poppler/-/work_items/1715, and Red Hat is tracking the flaw across RHEL 6-10 and Red Hat Hardened Images per the CPE data.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.
Executive ViewAI
A critical integer overflow vulnerability in Red Hat's Poppler PDF rendering library (CVE-2026-10118, CVSS 7.8) enables arbitrary code execution when users open malicious PDF documents. While no public exploit has been identified at the time of analysis, the lack of a vendor patch and the library's widespread deployment in RHEL 6-10 systems throughout enterprise infrastructure creates significant risk requiring immediate operational mitigations.
No vendor-released patch identified at time of analysis. Interim mitigations: disable PDF preview in email and document systems; implement PDF-to-image conversion for untrusted documents before display; deploy sandboxed rendering environments; restrict file upload sources and validate document provenance; monitor Poppler process execution and PDF file access; conduct user security awareness training on PDF risks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Same weakness CWE-190 – Integer Overflow or Wraparound
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB