CVE-2026-93313

EUVD-2026-82614
A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
6.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.65%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
freedesktoppoppler
26.7.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
poppler
bookworm
postponed
bookworm (security)
vulnerable
forky
26.07.0-3
fixed
sid
26.07.0-3
fixed
trixie
no-dsa
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
poppler
bionic
needs-triage
focal
needs-triage
jammy
Fixed 22.02.0-2ubuntu0.14
released
noble
Fixed 24.02.0-1ubuntu9.10
released
resolute
Fixed 26.01.0-2ubuntu0.2
released
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-JBIG2Stream-readCodeTableSeg-JBIG2Stream.cc-4118.md
https://gitlab.freedesktop.org/poppler/poppler/-/commit/eb87cf711563894649bd0c365baa479401dc6d51?merge_request_iid=2322
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2322
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1760
https://vuldb.com/cve/CVE-2026-93313
https://vuldb.com/submit/942346
https://vuldb.com/vuln/406612
https://vuldb.com/vuln/406612/cti