Description
A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.
Published: 2026-09-29
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local memory corruption
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an integer overflow in the FoFiTrueType::cvtSfnts function within Poppler’s TrueType font handling, causing a bound check failure that can corrupt memory while converting SFNT tables. This flaw can lead to crashes or corrupted data when processing untrusted PDF or font files, representing a local memory corruption risk classified under CWE-189 and CWE-190.

Affected Systems

Affected releases are Freedesktop Poppler 26.06.0, 26.07.0, and 26.08.0. Any installation of these versions that processes untrusted documents is vulnerable until the patch associated with commit 245d3c6823377755f2c1d5fdddd010279c6ed94d is applied.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity with limited exploitability; the flaw can be exploited only locally and is not listed in the CISA KEV catalog. No EPSS score is available, but the publicly disclosed exploit indicates that a local attacker can trigger the integer overflow to cause denial of service or potentially elevate privileges if local privileges are granted.

Generated by OpenCVE AI on September 30, 2026 at 08:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Poppler to a version that includes commit 245d3c6823377755f2c1d5fdddd010279c6ed94d, which fixes the integer overflow in FoFiTrueType.cc.
  • Restart any applications or services that load the Poppler library to ensure the patched code is in use.
  • Restrict local users from providing untrusted PDF or font input to Poppler-based components, such as running those components with least privilege or isolating them in containers.

Generated by OpenCVE AI on September 30, 2026 at 08:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8894-1 poppler vulnerabilities
History

Fri, 02 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 29 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.
Title Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow
First Time appeared Freedesktop
Freedesktop poppler
Weaknesses CWE-189
CWE-190
CPEs cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:*
Vendors & Products Freedesktop
Freedesktop poppler
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Freedesktop Poppler
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-02T12:26:30.155Z

Reserved: 2026-09-29T14:30:15.148Z

Link: CVE-2026-102620

cve-icon Vulnrichment

Updated: 2026-10-02T12:26:23.343Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T21:17:18.087

Modified: 2026-10-02T13:17:16.540

Link: CVE-2026-102620

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-29T20:30:15Z

Links: CVE-2026-102620 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T08:30:08Z

Weaknesses