Poppler versions 0.42.0 through 26.10.0 contain a stack‑based buffer overflow in the Decrypt::revision6Hash() function. When an attacker supplies a password longer than 127 bytes to an AESV3/R6 encrypted PDF, the library copies the excess data into the K1 and E buffers, overwriting adjacent stack memory. This can crash the application or corrupt memory, which can compromise confidentiality, integrity, or availability.

The vulnerability affects the freedesktop Poppler library, including libpoppler, libpoppler‑glib, and the C++ API. All applications that rely on these libraries to open AESV3/R6 encrypted PDFs and run Poppler 0.42.0 up to 26.10.0 are impacted.

The CVSS score of 8.3 indicates a high severity vulnerability with a large potential impact on confidentiality, integrity, and availability. EPSS is not available, and the lack of a KEV listing does not reduce the threat; the issue can be triggered locally by any user who opens a crafted PDF. Attackers would need to deliver a PDF that includes an overly long password; once processed, the buffer overflow can crash the process or corrupt stack memory. Based on the nature of typical stack overflows, the possibility of arbitrary code execution exists, but this is an inference, not explicitly stated in the CVE.