CVE-2026-102621: Poppler Buffer Overflow Vulnerability

CVE-2026-102621 Overview

CVE-2026-102621 is a signed integer overflow vulnerability in Freedesktop Poppler, an open source PDF rendering library used by many Linux applications. The flaw resides in the SplashClip::clipToPath function in splash/SplashClip.cc and affects Poppler versions up to and including 26.08.0. Exploitation requires local access and low privileges, and no user interaction is needed. The issue is tracked under CWE-189 (Numeric Errors). A public exploit reference exists, and the maintainers have published a fix in version 26.09.0 via commit 323c91036d99926a8b90dc14329f7b40aece22f8.

Critical Impact
A local attacker can trigger a signed integer overflow in Poppler's Splash clipping code, potentially causing limited availability impact in applications that render attacker-supplied PDF content.

Affected Products

Freedesktop Poppler versions up to 26.08.0
Applications and desktop environments that embed the vulnerable Poppler Splash renderer
Fixed release: Poppler 26.09.0

Discovery Timeline

2026-09-29 - CVE-2026-102621 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102621

Vulnerability Analysis

The vulnerability is a signed integer overflow inside SplashClip::clipToPath, part of Poppler's Splash 2D graphics backend used for rasterizing PDF pages. During clip path construction, arithmetic on path coordinates or bounding values is performed without adequate range checking. When a crafted PDF supplies extreme coordinate values, intermediate computations exceed the representable range of a signed integer, wrapping into an unintended value. That corrupted value is then used to size or index subsequent clipping operations, leading to inconsistent internal state within the renderer. The maintainers addressed the issue in upstream commit 323c91036d99926a8b90dc14329f7b40aece22f8, merged through Poppler merge request 2325.

Root Cause

The root cause is missing validation of integer arithmetic in the Splash clipping routine. Signed arithmetic on untrusted coordinate values falls under CWE-189. Because the renderer trusts the resulting sizes for downstream operations, the wrapped value produces an out-of-range condition that affects rendering correctness and process stability.

Attack Vector

Exploitation is limited to a local environment. An attacker with low privileges must supply a crafted PDF file that is opened by an application linking against a vulnerable Poppler build. Network delivery is not part of the attack surface for this specific issue, but PDFs staged on a shared filesystem or delivered through prior local access can trigger the flaw. The observed impact is limited to availability; there is no direct confidentiality or integrity impact reported. Technical detail on the overflow site is documented in the GitHub CVE summary.

No verified proof-of-concept code is included here. Refer to the linked references for reproduction detail.

Detection Methods for CVE-2026-102621

Indicators of Compromise

Unexpected crashes, aborts, or SIGSEGV events in processes that link against libpoppler when opening PDF files.
Presence of PDF files with unusually large or malformed path coordinate values staged in user-writable locations.
Installed Poppler package versions at or below 26.08.0 on Linux endpoints.

Detection Strategies

Inventory installed Poppler versions across Linux fleets using package managers such as dpkg -l poppler-utils or rpm -q poppler.
Monitor application crash telemetry for PDF viewers, converters, and thumbnailers that embed Poppler.
Correlate process termination events with recent PDF file access in endpoint telemetry.

Monitoring Recommendations

Enable core dump collection on servers that batch-process PDFs so overflow-driven crashes are captured for triage.
Alert on repeated crashes of the same PDF-handling binary originating from a single user or PDF source.
Track patch compliance for Poppler across container images and base OS builds during CI/CD scans.

How to Mitigate CVE-2026-102621

Immediate Actions Required

Upgrade Poppler to version 26.09.0 or later on all affected systems and rebuild dependent applications where required.
Update container images, virtual appliances, and developer workstations that bundle Poppler.
Restrict processing of untrusted PDFs to sandboxed accounts until patching is verified.

Patch Information

The fix is available in Poppler 26.09.0. The upstream code change is published in the GitLab Poppler commit 323c91036d99926a8b90dc14329f7b40aece22f8 and merged via Poppler merge request 2325. Additional tracking is available in the Poppler work item 1763 and the VulDB CVE report.

Workarounds

Avoid opening PDFs from untrusted sources on hosts running unpatched Poppler builds.
Run PDF rendering workloads inside restricted containers or seccomp-filtered sandboxes to contain crashes.
Disable automatic PDF thumbnailing in file managers on multi-user Linux hosts until the update is applied.

bash

# Verify installed Poppler version and upgrade on Debian/Ubuntu
dpkg -l | grep -E 'poppler|libpoppler'
sudo apt update && sudo apt install --only-upgrade poppler-utils libpoppler-cpp0v5

# Verify installed Poppler version and upgrade on RHEL/Fedora
rpm -q poppler poppler-utils
sudo dnf upgrade poppler poppler-utils