EUVD-2026-82624
GHSA-2g5c-g4rf-f9jv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious PDF delivered remotely but requires the victim to open it (UI:R, PR:N); integer overflow in font parsing yields at most a bounded OOB read (C:L) and crash (A:L), with no integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.
AnalysisAI
Rendering a crafted PDF with Freedesktop Poppler 26.07.0 can trigger a signed integer overflow in the TrueType font handler FoFiTrueType::mapCodeToGID when an embedded font supplies a manipulated segCnt value, producing a crash or a bounded out-of-bounds read rather than confirmed code execution. The flaw is remotely reachable with no authentication (CVSS 4.0 PR:N, CVSS 3.1 PR:N) but requires the victim or an automated pipeline to open or convert the attacker-supplied document (UI:P/UI:R), so it is not a hands-off network exploit; publicly available exploit code exists but there is no indication of confirmed active exploitation (no CISA KEV listing). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open or process an attacker-supplied PDF that embeds a crafted TrueType font with a manipulated segCnt value reaching FoFiTrueType::mapCodeToGID; this maps to UI:P/UI:R in the vector, so it is not hands-off remote exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, opportunistic-risk issue rather than a top-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the corrective change is upstream commit ed2a5538cf0a8d3ff908191eda9b73f91a5f952a, delivered through merge request 2315 (https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2315) and tracked in work item 1761, so the primary action is to rebuild Poppler from source at or after that commit - or install the first downstream distribution package that backports it - and then restart or rebuild every application that links the library (Evince, Okular, CUPS PDF filters, poppler-utils). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Pop
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for exa
Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote
In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a c
In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a poten
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today