CVE-2026-102620

EUVD-2026-89455
A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.59%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
freedesktoppoppler
26.6.0
CNA
freedesktoppoppler
26.7.0
CNA
freedesktoppoppler
26.8.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
poppler
bookworm
postponed
bookworm (security)
vulnerable
forky
26.07.0-4
fixed
sid
26.07.0-4
fixed
trixie
no-dsa
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
poppler
bionic
needs-triage
focal
needs-triage
jammy
Fixed 22.02.0-2ubuntu0.14
released
noble
Fixed 24.02.0-1ubuntu9.10
released
resolute
Fixed 26.01.0-2ubuntu0.2
released
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpoppler-cpp0
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
libpoppler-devel
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
libpoppler-glib-devel
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
libpoppler-glib8
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 12 SP3
0.43.0-16.77.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
libpoppler-qt4-4
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 12 SP3
0.43.0-16.77.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
libpoppler-qt4-devel
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
libpoppler117
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
libpoppler135
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
libpoppler60
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 12 SP3
0.43.0-16.77.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
libpoppler89
suse enterprise desktop 15 SP7
0.79.0-150200.3.56.1
fixed
suse enterprise sap 15 SP7
0.79.0-150200.3.56.1
fixed
suse enterprise server 15 SP4
0.79.0-150200.3.56.1
fixed
suse enterprise server 15 SP7
0.79.0-150200.3.56.1
fixed
poppler-tools
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 12 SP3
0.43.0-16.77.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
typelib-1_0-Poppler-0_18
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
Common Weakness Enumeration
References
https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-cvtSfnts-FoFiTrueType.cc-1210.md
https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fdddd010279c6ed94d
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2326
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1762
https://vuldb.com/cve/CVE-2026-102620
https://vuldb.com/submit/942348
https://vuldb.com/vuln/411410
https://vuldb.com/vuln/411410/cti