rootpwn

medium · CVSS v3 4.3

CVE-2026-93311

Freedesktop Poppler 26.07.0 contains an integer overflow in SampledFunction::SampledFunction in poppler/Function.cc, triggered by handling t

Overview

Freedesktop Poppler 26.07.0 contains an integer overflow in SampledFunction::SampledFunction in poppler/Function.cc, triggered by handling the BitsPerSample argument. The issue can be reached remotely when processing crafted PDF content. It matters because Poppler is widely used in PDF rendering and document-processing workflows, and the description states an exploit is public.

Description

A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.

Impact

The flaw is an integer overflow that can lead to memory corruption while parsing PDF sample-function data. Availability is the most direct concern, with possible denial of service during PDF processing. If memory corruption is successfully leveraged, confidentiality and integrity could also be affected in systems that process untrusted PDFs. Users, document conversion services, PDF viewers, and backend services using Poppler 26.07.0 are the primary impacted parties.

Remediation

Apply the vendor-provided patch or upgrade to a Poppler release that fixes the integer overflow in SampledFunction::SampledFunction. Until patched, restrict processing of untrusted PDFs, run PDF parsing in a sandboxed or least-privilege environment, and monitor for abnormal behavior or crashes in Poppler-based services.

Affected products

  • Freedesktop Poppler 26.07.0
  • Poppler PDF library
  • Applications embedding Poppler 26.07.0

Scores

Severity
medium
CVSS v2
5
CVSS v3
4.3
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-18441

The LatePoint Appointment Booking plugin for WordPress (v5.6.9 and earlier) contains an insecure direct object reference that allows unauthenticated users to enumerate customer records when guest checkout is enabled. Attackers can retrieve first name, last name, email, and phone number for any customer ID. This flaw exposes personally identifiable information without requiring authentication.

View analysis

medium

CVE-2026-2585

Brizy – Page Builder for WordPress has a stored cross-site scripting flaw in the rootAttributes parameter through version 2.8.14. Authenticated users with Contributor-level access or higher can inject scripts that run when visitors view affected pages. This matters because it can compromise site visitors and weaken trust in the WordPress site.

View analysis

medium

CVE-2026-93308

CVE-2026-93308 affects the VES Collector component of O-RAN-SC SMO OAM 2025-06-10. A remote attacker can manipulate an unknown functionality to trigger resource allocation, potentially exhausting system resources. The vulnerability is publicly known but no patch has been released yet.

View analysis