EUVD-2026-89437
GHSA-fxmp-c8v9-778f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PDF with overflowing clip path
-
DeliveryDeliver file to local user
-
ExploitVictim opens in Poppler-based viewer
-
ExecutionInteger overflow in SplashClip::clipToPath
-
ImpactRendering process crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a system running Poppler up to 26.08.0 and processing of an attacker-crafted PDF whose clip-path data triggers the signed integer overflow in SplashClip::clipToPath during Splash-based rasterization. In practice the attacker must get a victim to open or render the malicious document in a Poppler-backed application (viewer or CLI tool). Limiting factors: local attack vector only (no remote/network exploitation), impact confined to availability (process crash/DoS) with no confidentiality or integrity effect, and - despite the vendor's UI:N - realistic triggering depends on a user opening the crafted file. Fixed in 26.09.0. |
| Impact | This is a genuinely low-priority issue despite the alarming CWE class. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) yields only 4.8 (medium), and the impact metrics tell the real story: VC:N/VI:N/VA:L - no confidentiality or integrity impact and only LOW availability impact, meaning the realistic outcome of this signed integer overflow in SplashClip::clipToPath is a crash/denial of the rendering process, not code execution. The description explicitly states 'The attack can only be performed from a local environment' (AV:L), which sharply limits exposure. E:P in the vector plus the referenced GitHub write-up confirm publicly available exploit code exists, but this is a POC, NOT active exploitation - there is no KEV listing and no EPSS score provided, so there is no signal of widespread or automated exploitation. Note a modeling discrepancy: the vector sets PR:L/UI:N, yet a PDF-parsing overflow is normally reached by having a victim open an attacker-supplied document (UI:R) rather than by an authenticated local user - verify the intended trigger with the vendor. Bottom line: ubiquitous product, but low technical impact (DoS-only), local vector, and POC-not-KEV status make this a routine patch-in-cycle item, not an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious PDF whose clip-path geometry triggers a signed integer overflow in SplashClip::clipToPath during Splash rasterization. A victim opens the document locally in a Poppler-backed viewer (e.g., Evince, Okular) or processes it via a poppler CLI tool, causing the overflow and a crash of the rendering process. A public proof-of-concept write-up exists (github.com/r1ck9-2q), but the impact is limited to denial of service with no demonstrated code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Signed integer overflow in the Splash rasterization backend of Freedesktop Poppler (SplashClip::clipToPath in splash/SplashClip.cc) lets a local attacker crash or destabilize any Poppler-backed application that renders an attacker-crafted PDF, yielding a denial-of-service primitive with no confidentiality or integrity impact. Versions up to and including 26.08.0 are affected, publicly available exploit code exists (no KEV listing, so this is not confirmed active exploitation), and the flaw is fixed in 26.09.0. Exploitation is local in nature and requires the victim to open or render the malicious document, so despite the alarming CWE-190 integer-overflow class the realistic risk is low and availability-only.
RemediationAI
Upgrade Poppler to 26.09.0 or later; the vendor patch is upstream commit 323c91036d99926a8b90dc14329f7b40aece22f8, submitted via merge request https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2325 (vendor advisory: https://vuldb.com/vuln/411411), and distribution packagers should backport that commit if they cannot move to 26.09.0 immediately. Until every Poppler-linked component on a host is rebuilt against the fixed library, treat untrusted PDFs as hostile input: run rendering and conversion jobs as an unprivileged user inside a disposable container, or confine Poppler CLI tools and viewer processes with seccomp/AppArmor/bubblewrap profiles that block unnecessary syscalls and filesystem writes - the trade-off is reduced functionality and possible breakage of font or plugin loading. Because the bug is only reachable during Splash rasterization, disabling Splash-based rendering in favor of a non-Splash backend (where the consuming application offers such an option) avoids the code path but may change output fidelity and is not available in most viewers. There is no vendor-released patch beyond the 26.09.0 upgrade, and since the impact is limited to a process crash, blocking untrusted document sources or sandboxing the renderer is a reasonable compensating control while patching is scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Poppler is the de facto open-source PDF rendering library, embedded in Evince, Okular, LibreOffice's PDF import, and command-line tools such as pdftoppm and pdftocairo. Splash is Poppler's native rasterizer: it converts vector PDF content, including clipping paths, into bitmaps, and SplashClip::clipToPath is the routine that transforms and intersects clip-path geometry for the current graphics state. Coordinate arithmetic on attacker-controlled path values can exceed the representable range of the integer type used, producing a signed integer overflow (CWE-190). CWE-190 covers arithmetic results that fall outside a variable's representable range; here it manifests as a malformed clip region during Splash rendering, which the process cannot safely complete. The CPE string cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:* wildcards every version, consistent with the advisory statement that all releases through 26.08.0 are affected and that 26.09.0 is the first fixed release. Because the defect lives in the shared Splash code path, every downstream consumer that rasterizes PDFs inherits the same exposure regardless of its own version.
Know when Poppler gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Local file-parsing bug reached by opening a crafted PDF, so AV:L and UI:R with PR:N; integer overflow causes only a rendering crash, so A:L and C/I:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Pop
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for exa
Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote
In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a c
In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a poten
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg
Exploit-DB