EUVD-2026-82931
GHSA-84rg-5qf5-cx44
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local crafted-PDF open requires user interaction (AV:L/UI:R), no privileges needed (PR:N), and impact is pure CPU-exhaustion DoS of the renderer (A:H, C:N/I:N).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration.
AnalysisAI
Rendering a crafted PDF through Poppler's Splash backend can pin a CPU core at 100% for an extended attacker-controlled duration. The flaw in SplashOutputDev::tilingPatternFill computes an excessive loop count from tiling-pattern geometry near the int32 limit, without allocating memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an application that renders untrusted PDFs specifically via Poppler's Splash rasterizer backend, and a victim/process that opens an attacker-supplied PDF (UI:R, AV:L - the file must reach and be opened locally). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modestly-severe availability-only issue, correctly rated Medium (vendor CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact patched version is specified in the provided data; consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-93653 and Bugzilla 2537005 for updated patch information and apply vendor-released updates as soon as they become available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Pop
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for exa
Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote
In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a c
In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a poten
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg
Same weakness CWE-606 – Unchecked Input for Loop Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today