Poppler vulnerabilities

In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document.

The FoFiTrueType::getCFFBlock function in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack.

The FoFiType1C::convertToType0 function in Poppler 0.59.0 has a heap-based buffer over-read vulnerability when encountering an out-of-bounds font dictionary index. This can be exploited by an attacker to launch a denial of service attack.

The FoFiType1C::convertToType0 function in Poppler 0.59.0 has a NULL pointer dereference vulnerability because a data structure is not initialized, allowing an attacker to launch a denial of service attack.

In Poppler 0.59.0, memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opFill, Gfx::doPatternFill, Gfx::doTilingPatternFill, and Gfx::drawForm calls. This is a different vulnerability than CVE-2017-14519.

In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files.

In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when handling malicious PDF files.

In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).

In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document.

An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of Poppler 0.53.0. Opening a specially crafted PDF file can lead to an overflow, resulting in out of bounds memory overwrite on the heap and potential arbitrary code execution.

A heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large number of color components during image rendering, resulting in heap corruption.

A heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an image resizing after allocation has already occurred, leading to heap corruption and potential code execution.

Integer overflow leading to heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before version 0.56 allows remote attackers to cause application crashes or possibly have unspecified other impacts via a crafted PDF document.

CVE-2015-8868 involves a heap-based buffer overflow in the ExponentialFunction::ExponentialFunction function in Poppler before version 0.40.0. This allows remote attackers to cause a denial of service or potentially execute arbitrary code via an invalid blend mode in the ExtGState dictionary in a crafted PDF document.

An out-of-bounds read vulnerability exists in libpoppler.so in Poppler through version 24.12.0 within the JBIG2Bitmap::combine function in JBIG2Stream.cc.

A flaw was found in Poppler's Pdfinfo utility. Using the -dests parameter with a malformed input file can cause the utility to crash.

A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause application crashes when handling malformed inputs associated with INT_MIN.

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc due to a misplaced isOk check.

NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify adbe.pkcs7.sha1 signatures on documents, allowing potential signature forgeries.

Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.

A vulnerability was identified in Freedesktop Poppler up to version 26.08.0 in the function SplashClip::clipToPath of file splash/SplashClip.cc. Manipulation leads to an integer overflow. The attack can only be performed from a local environment.

A vulnerability was found in Poppler versions 26.06.0, 26.07.0 and 26.08.0 in the function FoFiTrueType::cvtSfnts of file fofi/FoFiTrueType.cc, causing an integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized.

A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration.

A vulnerability was found in Freedesktop Poppler 26.07.0 affecting the function FoFiTrueType::mapCodeToGID in fofi/FoFiTrueType.cc. Manipulating the segCnt argument can lead to an integer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed and may be utilized.

A vulnerability was found in Freedesktop Poppler 26.07.0 affecting the function JBIG2Stream::readCodeTableSeg in poppler/JBIG2Stream.cc. Manipulation results in an integer overflow. The attack can be initiated remotely, and the exploit has been made public and could be used.

A flaw was found in Freedesktop Poppler 26.07.0 affecting the function JBIG2Stream::rewind in poppler/JBIG2Stream.cc. Manipulation causes a null pointer dereference. The attack can be initiated remotely, and the exploit has been published and may be used.

A vulnerability was detected in Freedesktop Poppler 26.07.0. The issue affects the SampledFunction::SampledFunction function in poppler/Function.cc, where manipulation of the BitsPerSample argument results in integer overflow. The attack can be performed remotely and the exploit is publicly available.

Denial-of-service (DoS) vulnerability in the internal JPEG2000 (JPX) decoding implementation of the Poppler fork developed by Innodata Labs. When an application processes an untrusted PDF file containing specially crafted JPXDecode images, a remote attacker can cause uncontrolled memory consumption. The flaw occurs in the JPXStream::readCodestream() function, where values controlled from the SIZ segment (such as img.nComps) are used for the memory allocation of tiles and components without adequate validation. This allows an attacker to force excessive memory allocation and cause a resource exhaustion, ultimately causing the pdftoppm process to terminate due to out-of-memory (OOM) conditions.

Integer overflow in Poppler's Splash backend tilingPatternFill function leads to undersized heap allocation and out-of-bounds write. Remote code execution, information disclosure, or denial of service possible.

Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).

A vulnerability in the pdfseparate utility of the poppler library version 25.04.0 allows an attacker to trigger infinite recursion by supplying a crafted PDF file. This leads to a Denial of Service (DoS).