EUVD-2026-89455
GHSA-j552-4gqh-7xmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft PDF with malformed embedded TrueType font
-
DeliveryDeliver file to local user
-
ExploitUser opens/converts via Poppler (cvtSfnts)
-
ExecutionInteger overflow in font conversion
-
ImpactMemory corruption / limited integrity impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local processing of attacker-controlled input by Poppler's font-conversion path: specifically, a crafted sfnt/TrueType font (typically embedded in a PDF being rendered or converted to PostScript/Type42 via pdftops) that reaches FoFiTrueType::cvtSfnts. Limiting factors: the CVSS vector is AV:L (local only, no remote/network reach in the assessed vector) with PR:L (some local access/privilege) - a victim or local process must open or convert the malicious file. Impact is bounded to VI:L (limited integrity) with no confidentiality or availability impact per the vendor vector, so this is not a straightforward RCE. Affects Poppler 26.06.0, 26.07.0, and 26.08.0; fixed by commit 245d3c6823377755f2c1d5fdddd010279c6ed94d. |
| Impact | This is a genuinely low-priority issue despite a publicly disclosed PoC. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores only 4.8 (Medium), driven down by the local attack vector and the fact that the sole impact is VI:L (limited integrity) with no confidentiality (VC:N) and no availability (VA:N) impact. The integer overflow in FoFiTrueType::cvtSfnts is reached only when Poppler processes a crafted sfnt/TrueType font (typically embedded in a PDF being converted to PostScript/Type42), so exploitation requires the victim or a local process to feed the malicious input to the library. Key signals conflict with the severity: publicly available exploit code exists (confirmed via the GitHub write-up and E:P in the vector), but there is no EPSS score, no CISA KEV listing, and the report originates from VulDB rather than an independent researcher advisory or vendor security bulletin. Net assessment: real but minor - a patch (commit 245d3c6823...) is available and should be applied via normal update cadence, not emergency response. Note the 'Information Disclosure' tag conflicts with the CVSS impact (VC:N), which indicates NO confidentiality/disclosure impact - treat this as an integrity/memory-safety bug, not a data-leak. |
| Exploit ScenarioDerived | An attacker crafts a PDF containing a malicious embedded TrueType/sfnt font with dimensions that trigger a signed integer overflow in FoFiTrueType::cvtSfnts when a local user opens or converts the document (e.g., via pdftops or a Poppler-backed viewer). A public PoC/write-up documenting the overflow at FoFiTrueType.cc:1210 already exists, lowering the effort to reproduce. Because the flaw is local-only with limited integrity impact, realistic outcomes are memory corruption or crashes during font conversion rather than remote code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
A signed integer overflow (CWE-190) in Poppler's TrueType font conversion path, specifically FoFiTrueType::cvtSfnts in fofi/FoFiTrueType.cc, lets an attacker who supplies a crafted sfnt/TrueType font - typically embedded inside a PDF that is rendered or converted with tools such as pdftops - corrupt the handling of font table lengths during conversion. The defect affects Poppler 26.06.0, 26.07.0 and 26.08.0 and is reachable only locally, when a victim or local process opens or converts the malicious file; the assessed impact is bounded to limited integrity loss (VI:L) with no confidentiality or availability impact, so this is not a straightforward remote code execution issue. Publicly available exploit code exists and has been disclosed alongside a signed-overflow write-up in a public GitHub repository, and upstream has published a fix as commit 245d3c6823377755f2c1d5fdddd010279c6ed94d (merge request !2326); despite the public PoC, the CVSS v4.0 score of 4.8 and the vendor vector (AV:L/PR:L, VI:L, E:P) keep this a low-priority issue for most deployments.
RemediationAI
The primary fix is the upstream patch commit 245d3c6823377755f2c1d5fdddd010279c6ed94d (merge request !2326, https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2326), which addresses the signed overflow in FoFiTrueType::cvtSfnts; upstream fix available (PR/commit), with a released patched version not independently confirmed, so distribution users should track their vendor's Poppler package for a rebuild that includes this commit rather than assuming a specific numbered release contains it. Because the defect only triggers when a crafted font is converted, an effective interim mitigation is to avoid running affected Poppler conversion tools such as pdftops on untrusted PDFs, or to run them inside a sandbox or container with no write access outside a scratch directory - the trade-off is that this blocks legitimate document-conversion workflows and any remaining in-process use of the library by a viewer still hits the vulnerable path. Deployments that must process untrusted documents can additionally restrict which tools are exposed (for example, removing pdftops from user-invokable paths or from print filters) and monitor for crashes in font-conversion code; note that because the assessed impact is limited integrity with no confidentiality or availability loss, the practical urgency of these compensating controls is low compared with applying the upstream commit. Background references: https://vuldb.com/vuln/411410 and https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1762.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Poppler is the FreeDesktop PDF rendering library used by countless viewers, printers and document pipelines. Its FoFi (font file) subsystem, and specifically FoFiTrueType::cvtSfnts, rewrites an incoming TrueType/OpenType (sfnt) font into a form suitable for embedding in PostScript/Type 42 output, which means it parses attacker-controlled table directory entries - lengths, offsets and checksums - and performs arithmetic on those 32-bit fields before sizing and populating output buffers. The weakness class here is CWE-190 (Integer Overflow or Wraparound): an unchecked arithmetic operation on an attacker-supplied font metric wraps, so a downstream length or offset computation no longer matches the actual data, producing a mis-sized or mis-positioned write when the font is rewritten. Poppler is tracked as cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:*; the CVE description narrows the confirmed affected builds to 26.06.0, 26.07.0 and 26.08.0, and the upstream tracker work item is 1762. Exploitation requires the crafted font to reach that conversion routine (for example a font embedded in a PDF that is rendered or run through pdftops), which is why the attack is classed as local rather than network-reachable, and the assessed vector requires a user to open or convert the file (UI:R/PR:N in the assessed CVSS 3.1 vector, whereas VulDB's CVSS 4.0 vector lists PR:L/UI:N - authentication and interaction requirements are therefore best treated as "local access plus processing of an attacker-supplied document" rather than a single canonical answer).
Know when Poppler gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Local file processing (AV:L) requires the victim to open/convert a crafted font (UI:R), needs no prior privilege (PR:N); integer overflow yields limited corruption (I:L) and possible crash (A:L), no data leak (C:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Pop
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
An issue was discovered in Poppler 0.74.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, n
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for exa
Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote
In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a c
In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a poten
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg
Exploit-DB