EUVD-2026-33694
GHSA-469x-qwp6-693q
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.
AnalysisAI
Local code execution in Poppler's Splash rendering backend allows attackers to compromise applications that open attacker-supplied PDFs by triggering an integer overflow in tilingPatternFill that produces an undersized heap allocation and a subsequent out-of-bounds write. The flaw affects Poppler as shipped across Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with impact including arbitrary code execution, information disclosure, or denial of service in the rendering process. No public exploit identified at time of analysis, and the CVSS 7.8 vector requires user interaction to open a malicious PDF.
Technical ContextAI
Poppler is a widely embedded PDF rendering library derived from Xpdf and used by desktop viewers (Evince, Okular), thumbnailers, file managers, and server-side document converters across Linux distributions. The Splash backend is Poppler's software rasterizer; the tilingPatternFill function implements PDF tiling pattern fills, which repeat a small pattern cell across a region. The root cause is CWE-190 (Integer Overflow or Wraparound): arithmetic on pattern dimensions wraps to a small value, leading to an undersized heap buffer being allocated while subsequent rasterization writes the full uncapped extent, producing a heap out-of-bounds write that can corrupt adjacent allocator metadata or object pointers and ultimately steer execution. The upstream issue is tracked at gitlab.freedesktop.org/poppler/poppler/-/work_items/1715, and Red Hat is tracking the flaw across RHEL 6-10 and Red Hat Hardened Images per the CPE data.
RemediationAI
No vendor-released patch identified at time of analysis; the upstream fix is being coordinated in the Poppler GitLab work item 1715 and Red Hat is tracking per-RHEL erratum in Bugzilla 2460428, so monitor access.redhat.com/security/cve/CVE-2026-10118 and apply the poppler package updates for your RHEL major version as soon as errata ship via yum/dnf update poppler poppler-glib poppler-utils followed by restarting any long-running document viewers or conversion services. As compensating controls until a patched build is available, restrict opening of untrusted PDFs (train users to avoid email attachments and unknown downloads), disable automatic PDF thumbnailing in file managers (gsettings org.gnome.nautilus.preferences show-image-thumbnails 'never' and equivalent for KDE, at the cost of losing previews), route server-side PDF processing through sandboxed containers or seccomp/bubblewrap-confined workers to contain a successful heap corruption, and consider switching desktop users to a non-Splash renderer or a sandboxed alternative such as a browser's built-in PDF viewer for untrusted documents (trade-off: feature parity and rendering fidelity).
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today