CVE-2026-93312

EUVD-2026-82613
A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 34.65%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
freedesktoppoppler
26.7.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
poppler
bookworm
postponed
bookworm (security)
vulnerable
forky
26.07.0-3
fixed
sid
26.07.0-3
fixed
trixie
no-dsa
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
poppler
bionic
needs-triage
focal
needs-triage
jammy
Fixed 22.02.0-2ubuntu0.14
released
noble
Fixed 24.02.0-1ubuntu9.10
released
resolute
Fixed 26.01.0-2ubuntu0.2
released
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/r1ck9-2q/cve_summit/blob/main/Null-pointer-offset-undefined-behavior-in-JBIG2Stream-rewind-JBIG2Stream.cc-1229.md
https://gitlab.freedesktop.org/poppler/poppler/-/commit/5e49250f13b0390edeb3f90eb4c02c9941f97067
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2314
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1759
https://vuldb.com/cve/CVE-2026-93312
https://vuldb.com/submit/942345
https://vuldb.com/vuln/406610
https://vuldb.com/vuln/406610/cti
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1759
https://vuldb.com/submit/942345