CVE-2026-107705: Poppler Buffer Overflow Vulnerability

CVE-2026-107705 Overview

CVE-2026-107705 is a stack-based buffer overflow [CWE-121] in the Poppler PDF rendering library. The flaw resides in the Decrypt::revision6Hash() function and affects Poppler versions 0.42.0 through 26.10.0. An attacker who controls the password supplied when opening an AESV3/R6 encrypted PDF can overflow the fixed-size K1 and E stack buffers. Passwords longer than 127 bytes write past the end of these buffers, corrupting adjacent stack memory and crashing the host process. Applications consuming libpoppler, libpoppler-glib, or the C++ API are all exposed when they forward attacker-controlled passwords into Poppler.

Critical Impact
A password-controlled stack buffer overflow in Poppler's AESV3/R6 decryption path enables memory corruption and process crashes in any application that passes untrusted passwords to the library.

Affected Products

Poppler 0.42.0 through 26.10.0
Applications linking libpoppler or libpoppler-glib
Downstream consumers of the Poppler C++ API that forward user-supplied PDF passwords

Discovery Timeline

2026-10-08 - CVE-2026-107705 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107705

Vulnerability Analysis

Poppler implements the PDF 2.0 Revision 6 (R6) password handling routine in Decrypt::revision6Hash(). The function derives an encryption key from the user or owner password by iteratively hashing the password alongside intermediate state. During each iteration, Poppler stages data in two fixed-size stack buffers named K1 and E. The buffer sizes assume the password length stays within the PDF specification's 127-byte limit. The function does not clamp or validate the caller-supplied password length before writing it into these buffers. When the password exceeds 127 bytes, the write overruns both buffers and corrupts the surrounding stack frame.

The condition is reachable through any API path that opens an encrypted PDF with a caller-provided password, including bindings used by viewers, converters, and server-side PDF processors. Because the attacker controls the oversized password string, both the overflow length and the overwritten bytes are attacker-influenced.

Root Cause

The root cause is missing length validation on the password argument before it is copied into the fixed-size K1 and E stack buffers inside Decrypt::revision6Hash(). The affected code path can be reviewed in the Poppler Decrypt source.

Attack Vector

Exploitation requires the victim application to invoke Poppler's decryption routine with an attacker-controlled password. In interactive viewers, this requires user interaction to enter a crafted password. In automated pipelines, headless converters, or web services that accept passwords alongside PDFs, the overflow can be triggered without user interaction. The immediate impact is process crash and stack memory corruption. Deeper memory-safety consequences depend on compiler mitigations such as stack canaries and ASLR in the host build.

No public proof-of-concept exploit is listed in the referenced advisories. See the VulnCheck advisory and Poppler Merge Request #2398 for the upstream fix.

Detection Methods for CVE-2026-107705

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in processes linking libpoppler, libpoppler-glib, or Poppler-based utilities such as pdftotext, pdftoppm, and pdfinfo.
Stack-smashing termination messages produced by glibc's __stack_chk_fail from Poppler-linked binaries.
PDF ingestion requests that submit password strings longer than 127 bytes to server-side PDF processors.

Detection Strategies

Inventory installed Poppler versions across workstations, build systems, and servers; flag any package in the range 0.42.0 through 26.10.0.
Instrument PDF-processing services to log the length of caller-supplied passwords and alert on any value above 127 bytes.
Run suspect PDF-handling binaries under AddressSanitizer in test environments to confirm whether the overflow is reachable from a specific integration path.

Monitoring Recommendations

Monitor crash telemetry and core dump collectors for repeated faults in Decrypt.cc frames or revision6Hash symbols.
Track execution of Poppler command-line tools processing externally sourced PDFs and correlate with password-length anomalies.
Alert on repeated open attempts against the same encrypted PDF from a single source, which can indicate overflow fuzzing against a server-side consumer.

How to Mitigate CVE-2026-107705

Immediate Actions Required

Upgrade Poppler to a release that incorporates Merge Request #2398 once distributions publish a fixed package.
Enumerate first-party and third-party applications that bundle libpoppler or libpoppler-glib and schedule coordinated updates.
Constrain password length at the application layer to 127 bytes before passing the value into Poppler APIs.

Patch Information

The upstream fix is tracked in Poppler Work Item #1814 and Merge Request #2398. Monitor the Poppler GitLab repository and your Linux distribution security advisories for the corresponding tagged release and backported package versions.

Workarounds

Reject or truncate PDF passwords exceeding 127 bytes before they reach Poppler.
Isolate PDF processing in sandboxed or containerized workers with restricted syscalls to contain crashes and memory corruption.
Disable automatic processing of encrypted PDFs from untrusted sources until a patched Poppler build is deployed.

bash

# Example: enumerate Poppler package versions on Debian/Ubuntu hosts
dpkg -l | grep -Ei 'poppler|libpoppler'

# Example: enumerate Poppler package versions on RHEL/Fedora hosts
rpm -qa | grep -Ei 'poppler'