CVE-2026-102621

EUVD-2026-89437
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.42%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
freedesktoppoppler
26.8
CNA
Debian logo
Debian Releases
Debian Product
Codename
poppler
bookworm
postponed
bookworm (security)
vulnerable
forky
26.07.0-4
fixed
sid
26.07.0-4
fixed
trixie
no-dsa
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
poppler
bionic
needs-triage
focal
needs-triage
jammy
Fixed 22.02.0-2ubuntu0.14
released
noble
Fixed 24.02.0-1ubuntu9.10
released
resolute
Fixed 26.01.0-2ubuntu0.2
released
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpoppler-cpp0
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
libpoppler-devel
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
libpoppler-glib-devel
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
libpoppler-glib8
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 12 SP3
0.43.0-16.77.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
libpoppler-qt4-4
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 12 SP3
0.43.0-16.77.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
libpoppler-qt4-devel
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
libpoppler117
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
libpoppler135
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
libpoppler60
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 12 SP3
0.43.0-16.77.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
libpoppler89
suse enterprise desktop 15 SP7
0.79.0-150200.3.56.1
fixed
suse enterprise sap 15 SP7
0.79.0-150200.3.56.1
fixed
suse enterprise server 15 SP4
0.79.0-150200.3.56.1
fixed
suse enterprise server 15 SP7
0.79.0-150200.3.56.1
fixed
poppler-tools
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 12 SP5
0.43.0-16.77.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 12 SP3
0.43.0-16.77.1
fixed
suse enterprise server 12 SP5
0.43.0-16.77.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
typelib-1_0-Poppler-0_18
suse enterprise desktop 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise sap 15 SP7
24.03.0-150600.3.34.1
fixed
suse enterprise server 15 SP4
22.01.0-150400.3.51.1
fixed
suse enterprise server 15 SP7
24.03.0-150600.3.34.1
fixed
Common Weakness Enumeration
References
https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-SplashClip-clipToPath-SplashClip.cc-214.md
https://gitlab.freedesktop.org/poppler/poppler/-/commit/323c91036d99926a8b90dc14329f7b40aece22f8
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2325
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1763
https://vuldb.com/cve/CVE-2026-102621
https://vuldb.com/submit/942349
https://vuldb.com/vuln/411411
https://vuldb.com/vuln/411411/cti