Skip to content
Fencer Vulns
medium 6.5

CVE-2026-107705 json

Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()

published 2026-10-08 31 d ago modified 2026-10-14 25 d ago also EUVD-2026-95208

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.

Patch / fix

  • poppler Debian 14 26.07.0-4

debian advisories DEBIAN-CVE-2026-107705

  • poppler Ubuntu 22.04 LTS 22.02.0-2ubuntu0.15
  • poppler Ubuntu 24.04 LTS 24.02.0-1ubuntu9.11
  • poppler Ubuntu 26.10 26.07.0-2ubuntu1.1
  • poppler Ubuntu 26.04 LTS 26.01.0-2ubuntu0.3

ubuntu advisories UBUNTU-CVE-2026-107705

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • poppler hummingbird 1 26.08.0-1.4.hum1
  • poppler-cpp hummingbird 1 26.08.0-1.4.hum1
  • poppler-qt6 hummingbird 1 26.08.0-1.4.hum1
  • poppler-glib hummingbird 1 26.08.0-1.4.hum1
  • poppler-utils hummingbird 1 26.08.0-1.4.hum1
  • poppler hummingbird 1 26.08.0-1.3.hum1
  • poppler-cpp hummingbird 1 26.08.0-1.3.hum1
  • poppler-qt6 hummingbird 1 26.08.0-1.3.hum1

red hat advisories RHSA-2026:80579RHSA-2026:80172

  • poppler openSUSE Tumbleweed 26.10.0-1.1

opensuse advisories openSUSE-SU-2026:12145-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-107705 updated cvss 5.5

poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption

  • Red Hat Enterprise Linux 8 poppler, poppler-cpp, poppler-qt5, poppler-glib, poppler-utils, poppler 24.02.0-10.el10 Red Hat Enterprise Linux 9 poppler, poppler-cpp, poppler-qt5, poppler-glib, poppler-utils, poppler 24.02.0-10.el10 Red Hat Enterprise Linux 10 poppler 24.02.0-10.el10
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images poppler 26.08.0-1.3.hum1, poppler 26.08.0-1.4.hum1, poppler-cpp 26.08.0-1.3.hum1, poppler-cpp 26.08.0-1.4.hum1, poppler-qt6 26.08.0-1.3.hum1, poppler-qt6 26.08.0-1.4.hum1, +4 more
    fixed: vendor fix RHSA-2026:80172
  • Red Hat Enterprise Linux 6 poppler, poppler-qt, poppler-qt4, poppler-glib, poppler-utils, poppler 24.02.0-10.el10 Red Hat Enterprise Linux 7 poppler, poppler-qt, poppler-cpp, poppler-glib, poppler-demos, poppler-utils, +5 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
25 d ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CNA 4.0 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • freedesktop poppler

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.