Poppler CVE-2026-107705

Exploitation requires the target application to open an AESV3/R6 (AES-256 revision 6) encrypted PDF using libpoppler, libpoppler-glib, or the Poppler C++ API, AND for the attacker to control the password string supplied to the decryption call, which must exceed 127 bytes to overflow the fixed-size K1 and E stack buffers in Decrypt::revision6Hash(). The principal limiting factor (reflected as AT:P in the CVSS 4.0 vector) is that the attacker must influence the password input: in interactive PDF viewers the password is normally user-chosen, so the realistic exposure is automated/server-side PDF processing services that pass externally supplied passwords to Poppler, or workflows where both the encrypted file and its password come from an untrusted source. Applications that never open encrypted/R6 PDFs or that constrain password length before passing it to Poppler are not exposed.

The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N, base 8.3 High) describes a network-reachable, low-complexity, unauthenticated flaw with a present attack requirement (AT:P) - namely that the attacker must control the password string passed to the decrypt routine. Impact is weighted toward availability (VA:H, process crash) with only Low integrity impact (VI:L, memory corruption) and no confidentiality impact (VC:N), which signals that the realistic, demonstrated outcome is denial of service rather than confirmed reliable code execution. The description notes memory can be 'corrupted,' leaving code execution theoretically possible for CWE-121 stack overflows, but neither the vendor rating (integrity only Low) nor any POC substantiates weaponized RCE. No EPSS score, no CISA KEV listing, and no POC indicator are present in the provided data; SSVC decision inputs (exploitation/automatable/technical-impact) were not supplied. Exploitation status is therefore: no public exploit identified at time of analysis. The AT:P attack requirement is the key moderating signal - exploitation depends on the attacker being able to supply the password to the vulnerable API, which is unusual for interactive viewers (where the user chooses the password) and most plausible in automated/server-side PDF pipelines. Net: a legitimately High-severity memory-safety bug in a very widely deployed library, but absent KEV/POC/EPSS and given the DoS-dominant impact and password-control prerequisite, it is a patch-promptly priority rather than an emergency drop-everything issue.

An attacker targets a server-side or automated service that uses libpoppler/libpoppler-glib/C++ API to open AESV3/R6 (AES-256, revision 6) encrypted PDFs and accepts an attacker-influenced password. By submitting a password longer than 127 bytes, the attacker overflows the K1 and E stack buffers inside Decrypt::revision6Hash(), crashing the process and corrupting stack memory. No public exploit code is identified at time of analysis; the attacker must control the password value passed to the library (AT:P), so interactive viewers where the user chooses the password are far less exposed than automated decryption pipelines.