Skip to content
Fencer Vulns
high 7.8

CVE-2026-10118 json

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

published 2026-06-01 5 mo ago modified 2026-11-04 4 d ago also EUVD-2026-33694

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits
0
none known

Summary

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:24.02.0-7.el10_2.2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:24.02.0-7.el10_0.1
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:0.22.5-7.el7_9, 0:0.26.5-44.el7_9
  • Red Hat Red Hat Enterprise Linux 8 0:20.11.0-14.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:20.11.0-2.el8_4.3
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:20.11.0-2.el8_4.3
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:20.11.0-5.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:20.11.0-5.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:20.11.0-7.el8_8.1
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:20.11.0-7.el8_8.1
  • Red Hat Red Hat Enterprise Linux 9 0:21.01.0-24.el9_8.1
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:21.01.0-15.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:21.01.0-20.el9_4.1
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:21.01.0-22.el9_6.1
  • Red Hat Red Hat AI Inference Server 3.3 1782352847, 1782352919, 1782352950, 1782353093
  • Red Hat Red Hat Hardened Images 26.06.0-0.1.hum1
  • Red Hat Red Hat OpenShift AI 3.4 1790703542
  • poppler Debian 12 22.12.0-2+deb12u2
  • poppler Debian 13 25.03.0-5+deb13u3
  • poppler Debian 14 26.01.0-4.1

debian advisories DEBIAN-CVE-2026-10118

  • poppler Ubuntu 22.04 LTS 22.02.0-2ubuntu0.13
  • poppler Ubuntu 24.04 LTS 24.02.0-1ubuntu9.9
  • poppler Ubuntu 25.10 25.03.0-10ubuntu0.2
  • poppler Ubuntu 26.04 LTS 26.01.0-2ubuntu0.1

ubuntu advisories UBUNTU-CVE-2026-10118

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • poppler hummingbird 1 26.06.0-0.1.hum1
  • poppler-cpp hummingbird 1 26.06.0-0.1.hum1
  • poppler-qt6 hummingbird 1 26.06.0-0.1.hum1
  • poppler-glib hummingbird 1 26.06.0-0.1.hum1
  • poppler-utils hummingbird 1 26.06.0-0.1.hum1
  • poppler RHEL 9 21.01.0-24.el9_8.1
  • poppler-cpp RHEL 9 21.01.0-24.el9_8.1
  • poppler-qt5 RHEL 9 21.01.0-24.el9_8.1

red hat advisories RHSA-2026:30134RHSA-2026:30044RHSA-2026:29952RHSA-2026:27727RHSA-2026:27724RHSA-2026:27725

  • poppler AlmaLinux 8 20.11.0-14.el8_10
  • poppler-cpp AlmaLinux 8 20.11.0-14.el8_10
  • poppler-qt5 AlmaLinux 8 20.11.0-14.el8_10
  • poppler-glib AlmaLinux 8 20.11.0-14.el8_10
  • poppler-utils AlmaLinux 8 20.11.0-14.el8_10
  • poppler AlmaLinux 10 24.02.0-7.el10_2.2
  • poppler-cpp AlmaLinux 10 24.02.0-7.el10_2.2
  • poppler-qt6 AlmaLinux 10 24.02.0-7.el10_2.2

almalinux advisories ALSA-2026:24984ALSA-2026:24985ALSA-2026:25058

  • poppler Rocky Linux 10 24.02.0-7.el10_2.2
  • poppler Rocky Linux 9 21.01.0-24.el9_8.1
  • poppler Rocky Linux 8 20.11.0-14.el8_10

rocky linux advisories RLSA-2026:24985RLSA-2026:25058RLSA-2026:24984

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-10118 updated cvss 7.8

poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication

  • Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1782352847, rhaiis/vllm-rocm-rhel9 1782353093, rhaiis/vllm-spyre-rhel9 1782352919, rhaiis/model-opt-cuda-rhel9 1782352950
    fixed: vendor fix RHSA-2026:30078
  • Red Hat CodeReady Linux Builder EUS (v.9.6) poppler-devel 21.01.0-22.el9_6.1, poppler-glib-doc 21.01.0-22.el9_6.1, poppler-cpp-devel 21.01.0-22.el9_6.1, poppler-debuginfo 21.01.0-22.el9_6.1, poppler-qt5-devel 21.01.0-22.el9_6.1, poppler-glib-devel 21.01.0-22.el9_6.1, +5 more
    fixed: vendor fix RHSA-2026:27721
  • Red Hat Enterprise Linux AppStream (v. 8) poppler 20.11.0-14.el8_10, poppler-qt5 20.11.0-14.el8_10, poppler-glib 20.11.0-14.el8_10, poppler-utils 20.11.0-14.el8_10
    fixed: vendor fix RHSA-2026:24984
  • Red Hat Enterprise Linux AppStream (v. 9) poppler 21.01.0-24.el9_8.1, poppler-cpp 21.01.0-24.el9_8.1, poppler-qt5 21.01.0-24.el9_8.1, poppler-glib 21.01.0-24.el9_8.1, poppler-utils 21.01.0-24.el9_8.1
    fixed: vendor fix RHSA-2026:25058
  • Red Hat Enterprise Linux AppStream (v. 10) poppler 24.02.0-7.el10_2.2, poppler-cpp 24.02.0-7.el10_2.2, poppler-qt6 24.02.0-7.el10_2.2, poppler-glib 24.02.0-7.el10_2.2, poppler-utils 24.02.0-7.el10_2.2
    fixed: vendor fix RHSA-2026:24985
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) poppler 20.11.0-2.el8_4.3, poppler-glib 20.11.0-2.el8_4.3, poppler-utils 20.11.0-2.el8_4.3
    fixed: vendor fix RHSA-2026:27727
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) poppler 20.11.0-5.el8_6.1, poppler-glib 20.11.0-5.el8_6.1, poppler-utils 20.11.0-5.el8_6.1
    fixed: vendor fix RHSA-2026:27725
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) poppler 20.11.0-7.el8_8.1, poppler-qt5 20.11.0-7.el8_8.1, poppler-glib 20.11.0-7.el8_8.1, poppler-utils 20.11.0-7.el8_8.1
    fixed: vendor fix RHSA-2026:27724
show 15 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) poppler 21.01.0-15.el9_2.1, poppler-cpp 21.01.0-15.el9_2.1, poppler-qt5 21.01.0-15.el9_2.1, poppler-glib 21.01.0-15.el9_2.1, poppler-utils 21.01.0-15.el9_2.1
    fixed: vendor fix RHSA-2026:27723
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) poppler 21.01.0-20.el9_4.1, poppler-cpp 21.01.0-20.el9_4.1, poppler-qt5 21.01.0-20.el9_4.1, poppler-glib 21.01.0-20.el9_4.1, poppler-utils 21.01.0-20.el9_4.1
    fixed: vendor fix RHSA-2026:27722
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) poppler 24.02.0-7.el10_0.1, poppler-cpp 24.02.0-7.el10_0.1, poppler-qt6 24.02.0-7.el10_0.1, poppler-glib 24.02.0-7.el10_0.1, poppler-utils 24.02.0-7.el10_0.1
    fixed: vendor fix RHSA-2026:27720
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) poppler 21.01.0-22.el9_6.1, poppler-cpp 21.01.0-22.el9_6.1, poppler-qt5 21.01.0-22.el9_6.1, poppler-glib 21.01.0-22.el9_6.1, poppler-utils 21.01.0-22.el9_6.1
    fixed: vendor fix RHSA-2026:27721
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) poppler 20.11.0-2.el8_4.3, poppler-glib 20.11.0-2.el8_4.3, poppler-utils 20.11.0-2.el8_4.3
    fixed: vendor fix RHSA-2026:27727
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) poppler 20.11.0-5.el8_6.1, poppler-glib 20.11.0-5.el8_6.1, poppler-utils 20.11.0-5.el8_6.1
    fixed: vendor fix RHSA-2026:27725
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) poppler 20.11.0-7.el8_8.1, poppler-qt5 20.11.0-7.el8_8.1, poppler-glib 20.11.0-7.el8_8.1, poppler-utils 20.11.0-7.el8_8.1
    fixed: vendor fix RHSA-2026:27724
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) poppler-devel 21.01.0-24.el9_8.1, poppler-glib-doc 21.01.0-24.el9_8.1, poppler-cpp-devel 21.01.0-24.el9_8.1, poppler-debuginfo 21.01.0-24.el9_8.1, poppler-qt5-devel 21.01.0-24.el9_8.1, poppler-glib-devel 21.01.0-24.el9_8.1, +5 more
    fixed: vendor fix RHSA-2026:25058
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) poppler-devel 24.02.0-7.el10_2.2, poppler-glib-doc 24.02.0-7.el10_2.2, poppler-cpp-devel 24.02.0-7.el10_2.2, poppler-debuginfo 24.02.0-7.el10_2.2, poppler-qt6-devel 24.02.0-7.el10_2.2, poppler-glib-devel 24.02.0-7.el10_2.2, +5 more
    fixed: vendor fix RHSA-2026:24985
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) poppler-devel 24.02.0-7.el10_0.1, poppler-glib-doc 24.02.0-7.el10_0.1, poppler-cpp-devel 24.02.0-7.el10_0.1, poppler-debuginfo 24.02.0-7.el10_0.1, poppler-qt6-devel 24.02.0-7.el10_0.1, poppler-glib-devel 24.02.0-7.el10_0.1, +5 more
    fixed: vendor fix RHSA-2026:27720
  • Red Hat Enterprise Linux CRB (v. 8) poppler-cpp 20.11.0-14.el8_10
    fixed: vendor fix RHSA-2026:24984
  • Red Hat Enterprise Linux Server (v. 7 ELS) poppler 0.26.5-44.el7_9, poppler-qt 0.26.5-44.el7_9, poppler-glib 0.26.5-44.el7_9, poppler-utils 0.26.5-44.el7_9, compat-poppler022 0.22.5-7.el7_9, compat-poppler022-qt 0.22.5-7.el7_9, +1 more Red Hat Enterprise Linux Server Optional (v. 7 ELS) poppler-qt 0.26.5-44.el7_9, poppler-cpp 0.26.5-44.el7_9, poppler-demos 0.26.5-44.el7_9, compat-poppler022-qt 0.22.5-7.el7_9, compat-poppler022-cpp 0.22.5-7.el7_9
    fixed: vendor fix RHSA-2026:29952
  • Red Hat Hardened Images poppler 26.06.0-0.1.hum1, poppler-cpp 26.06.0-0.1.hum1, poppler-qt6 26.06.0-0.1.hum1, poppler-glib 26.06.0-0.1.hum1, poppler-utils 26.06.0-0.1.hum1
    fixed: vendor fix RHSA-2026:30134
  • Red Hat OpenShift AI 3.4 rhai/base-image-neuron-rhel9 1790703542
    fixed: vendor fix RHSA-2026:74674
  • Red Hat Enterprise Linux 6 poppler, poppler-qt, poppler-qt4, poppler-glib, poppler-utils
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat AI Inference Server 3.3
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.