CVE-2026-93311 Overview
CVE-2026-93311 is an integer overflow vulnerability in Freedesktop Poppler 26.07.0. The flaw resides in the SampledFunction::SampledFunction constructor within poppler/Function.cc. Manipulation of the BitsPerSample argument triggers undefined behavior through a shift-exponent violation. The issue is classified under [CWE-189] (Numeric Errors) and can be triggered remotely by processing a crafted PDF document. A public proof-of-concept exists, and the upstream project has not yet responded to the bug report at the time of publication.
Critical Impact
A remote attacker can trigger undefined behavior in the Poppler PDF rendering library through a malformed BitsPerSample value, potentially causing application instability in software that processes untrusted PDF files.
Affected Products
- Freedesktop Poppler 26.07.0
- Applications embedding the Poppler library for PDF rendering
- Downstream Linux distributions shipping the affected Poppler release
Discovery Timeline
- 2026-09-18 - CVE-2026-93311 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93311
Vulnerability Analysis
The vulnerability resides in the SampledFunction constructor in poppler/Function.cc around line 376. Poppler parses the BitsPerSample value from a PDF function dictionary and uses it as the exponent in a bit-shift operation. When an attacker supplies an out-of-range BitsPerSample value, the shift operation exceeds the width of the target integer type. This produces undefined behavior under the C++ language specification and can result in an integer overflow condition.
Exploitation requires user interaction, such as opening a crafted PDF in a viewer that depends on Poppler for rendering. The impact is limited primarily to availability, since the undefined behavior most likely manifests as an application crash or memory corruption in the sampled function tables. Because Poppler is embedded in widely deployed viewers including Evince, Okular, and various command-line utilities, the attack surface extends across many desktop and server environments.
Root Cause
The root cause is the absence of validation on the BitsPerSample field before it is consumed by a left-shift expression. The code trusts the parsed value from the PDF stream and does not enforce the specification-defined range of 1 to 32 bits per sample. This unchecked arithmetic path is the primary defect referenced in the upstream GitLab work item for Poppler.
Attack Vector
The attack vector is network-adjacent with required user interaction. An attacker delivers a malicious PDF document through email, a web download, or file sharing. When a victim opens the document in an application backed by Poppler, the malformed sampled function dictionary is parsed and triggers the integer overflow. Detailed technical documentation is available in the GitHub CVE Summit writeup and the VulDB entry for CVE-2026-93311.
No verified exploitation code is reproduced here. Refer to the linked advisories for reproduction details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-93311
Indicators of Compromise
- Unexpected crashes or abnormal termination of PDF viewers such as Evince, Okular, or pdftoppm when processing untrusted documents.
- PDF files containing sampled function dictionaries with BitsPerSample values outside the specification range of 1 to 32.
- Core dumps or sanitizer reports from Poppler-linked processes referencing SampledFunction::SampledFunction or Function.cc.
Detection Strategies
- Deploy PDF content inspection at email and web gateways to flag documents with malformed function objects.
- Enable AddressSanitizer or UndefinedBehaviorSanitizer on Poppler builds in test environments to identify triggering samples.
- Correlate process crash telemetry from endpoint agents with recent PDF file access events to identify potential exploitation attempts.
Monitoring Recommendations
- Track version inventory of the Poppler library across Linux endpoints and identify hosts running the 26.07.0 release.
- Monitor dmesg, journald, and application logs for repeated segmentation faults in Poppler-consuming processes.
- Alert on abnormal child process spawns or memory anomalies immediately following PDF document opens.
How to Mitigate CVE-2026-93311
Immediate Actions Required
- Inventory all systems and applications that link against or invoke Poppler 26.07.0.
- Restrict opening of PDF documents from untrusted sources until a patched build is available.
- Sandbox PDF viewers using tools such as Firejail, bubblewrap, or SELinux confinement to contain the impact of any triggered undefined behavior.
Patch Information
At the time of publication, the Freedesktop Poppler project has been notified through the upstream GitLab work item but has not released an official patch. Track the work item for status changes and monitor distribution security advisories for backported fixes.
Workarounds
- Downgrade to a Poppler release predating 26.07.0 if downstream packages are available and unaffected.
- Route PDF rendering through hardened sandboxes or containerized viewers that isolate the Poppler process from user data.
- Use alternative PDF renderers for high-risk workflows involving documents from external sources until a patch is issued.
# Verify installed Poppler version on Linux hosts
pdfinfo -v 2>&1 | head -n 1
dpkg -l | grep -i poppler # Debian/Ubuntu
rpm -qa | grep -i poppler # RHEL/Fedora
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
