CVE-2026-93312 Overview
CVE-2026-93312 is a null pointer dereference vulnerability in Freedesktop Poppler version 26.07.0. The flaw resides in the JBIG2Stream::rewind function within poppler/JBIG2Stream.cc. An attacker can trigger the condition remotely by supplying a crafted PDF that exercises the JBIG2 stream decoder. Successful exploitation results in a process crash of any application that embeds the affected Poppler library, producing a denial-of-service condition. The issue is categorized under [CWE-404: Improper Resource Shutdown or Release]. A public exploit has been referenced, and upstream has released a fix in version 26.08.0 via commit 5e49250f13b0390edeb3f90eb4c02c9941f97067.
Critical Impact
Remote attackers can crash Poppler-based PDF viewers and document processors by delivering a malicious PDF that triggers a null pointer dereference in the JBIG2 stream handler.
Affected Products
- Freedesktop Poppler 26.07.0
- Applications embedding the vulnerable Poppler JBIG2 decoder (PDF viewers, thumbnailers, document converters)
- Linux desktop environments and server pipelines that render or index PDFs using Poppler
Discovery Timeline
- 2026-09-18 - CVE-2026-93312 published to NVD
- 2026-09-22 - Last updated in NVD database
- Patch commit - 5e49250f13b0390edeb3f90eb4c02c9941f97067 merged upstream in Poppler 26.08.0
Technical Details for CVE-2026-93312
Vulnerability Analysis
The defect lives in JBIG2Stream::rewind in poppler/JBIG2Stream.cc. JBIG2 is a bi-level image compression format that Poppler decodes when rendering PDFs containing scanned or monochrome imagery. The rewind routine assumes an internal stream pointer has been initialized before it dereferences a member offset. When a PDF supplies a malformed or unexpected JBIG2 segment order, that pointer remains null, and the offset arithmetic performed during rewind reads from an invalid address. The result is a deterministic crash of the host process. Because Poppler is embedded in Evince, Okular, pdftoppm, pdftotext, GNOME thumbnailers, and many server-side conversion pipelines, the reachable attack surface is broad. The vulnerability requires user interaction to open or process the document.
Root Cause
The function fails to validate that the stream state has been properly established before performing pointer arithmetic and dereferencing the resulting address. This is a classic improper resource state check that surfaces as null pointer offset undefined behavior at line 1229 of JBIG2Stream.cc, as documented in the GitHub null pointer bug report.
Attack Vector
An attacker crafts a PDF containing a malformed JBIG2 image stream and delivers it via email attachment, web download, or a document-processing service. When a victim opens the PDF, or an automated pipeline ingests it, the Poppler-based renderer invokes JBIG2Stream::rewind, dereferences the null pointer, and crashes. The impact is limited to availability of the affected process; the vulnerability does not enable code execution or data disclosure.
No verified proof-of-concept code is included here. See the GitLab merge request and the upstream commit for technical details of the fix.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-93312
Indicators of Compromise
- Repeated crashes of evince, okular, pdftoppm, pdftotext, or gnome-thumbnailer processes with SIGSEGV when handling PDF files
- Core dumps referencing JBIG2Stream::rewind in the stack trace
- PDF files containing malformed JBIG2 image streams delivered via mail or upload portals
Detection Strategies
- Monitor process termination telemetry for Poppler-linked binaries exiting with segmentation faults during PDF parsing
- Inspect PDF ingestion pipelines for input files that consistently cause worker crashes and correlate to JBIG2 segment structures
- Query endpoint telemetry for libpoppler versions to identify hosts still running the vulnerable 26.07.0 build
Monitoring Recommendations
- Enable crash reporting on Linux workstations and document-processing servers to capture stack traces referencing JBIG2Stream.cc
- Track outbound file conversion job failure rates as an early signal of malicious PDF submissions
- Alert on installation of unpatched Poppler packages through package-management event logs
How to Mitigate CVE-2026-93312
Immediate Actions Required
- Upgrade Poppler to version 26.08.0 or later on all endpoints, servers, and container images that render or process PDFs
- Rebuild and redeploy any downstream applications statically linked against Poppler 26.07.0
- Restrict processing of untrusted PDFs in automated pipelines until patched libraries are in place
Patch Information
The fix is applied upstream as commit 5e49250f13b0390edeb3f90eb4c02c9941f97067 and shipped in Freedesktop Poppler 26.08.0. Distribution maintainers have published or are publishing updated poppler, poppler-utils, and libpoppler packages. Apply vendor updates through the standard package manager, for example apt, dnf, zypper, or pacman, and restart any long-running services that link against the library.
Workarounds
- Disable automatic PDF thumbnail generation in file managers until the patched Poppler is installed
- Route untrusted PDF processing through sandboxed or containerized workers with restart-on-crash supervision
- Block or quarantine inbound PDFs containing JBIG2 streams at the mail gateway when patching is delayed
# Verify installed Poppler version and update on Debian or Ubuntu
dpkg -l | grep -E 'poppler|libpoppler'
sudo apt update && sudo apt install --only-upgrade poppler-utils libpoppler-glib8 libpoppler-cpp0v5
# Verify installed Poppler version and update on Fedora or RHEL
rpm -q poppler poppler-utils
sudo dnf upgrade poppler poppler-utils
# Confirm the patched version is 26.08.0 or later
pdftoppm -v
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
