CVE-2026-93313: Freedesktop Poppler Integer Overflow RCE

CVE-2026-93313 Overview

CVE-2026-93313 is an integer overflow vulnerability in Freedesktop Poppler 26.07.0. The flaw resides in the JBIG2Stream::readCodeTableSeg function within poppler/JBIG2Stream.cc. An attacker can trigger the overflow by supplying a crafted PDF containing malformed JBIG2 stream data. The issue is classified under [CWE-189] (Numeric Errors) and can be initiated remotely, though exploitation requires user interaction to open the document. Public disclosure of the exploit has occurred, and upstream maintainers have merged a fix under commit eb87cf711563894649bd0c365baa479401dc6d51.

Critical Impact

A malicious PDF processed by an application linking Poppler 26.07.0 can trigger a signed integer overflow in JBIG2 parsing, leading to memory corruption or process instability.

Affected Products

• Freedesktop Poppler 26.07.0
• Applications embedding the affected Poppler library for PDF rendering
• Downstream distributions packaging the vulnerable release

Discovery Timeline

• 2026-09-18 - CVE-2026-93313 published to NVD
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-93313

Vulnerability Analysis

The vulnerability is a signed integer overflow inside JBIG2Stream::readCodeTableSeg, the routine responsible for parsing JBIG2 code table segments embedded in PDF documents. Poppler uses these segments during Huffman table reconstruction when decoding JBIG2-compressed image streams. When arithmetic on segment size fields exceeds the representable range of a signed integer, the resulting wrap-around produces incorrect buffer sizing or loop bounds. Subsequent decoding operations then act on inconsistent state, which can lead to memory corruption or an abort during PDF processing. The bug is tracked publicly through the Poppler project as work item 1760 and addressed in merge request 2322.

Root Cause

The root cause is unchecked arithmetic on attacker-controlled 32-bit values that describe JBIG2 code table parameters. readCodeTableSeg combines these fields without validating that intermediate results remain within INT_MAX. A crafted document supplying boundary values causes the computation to overflow, yielding a smaller-than-expected size that is then trusted by downstream allocation and loop logic.

Attack Vector

Exploitation requires an attacker to deliver a malicious PDF and have a victim open it in an application that links against the vulnerable Poppler version. Delivery mechanisms include email attachments, drive-by download, or file-sharing platforms. Because Poppler is widely embedded in Linux document viewers such as Evince and Okular, and in server-side PDF conversion pipelines, the attack surface extends to both interactive users and automated processing services.

No verified public exploit code is available in a reproducible form. Technical details describing the overflow location and remediation are published in the GitHub JBIG2Stream Overflow Report and the GitLab Poppler Commit Update.

Detection Methods for CVE-2026-93313

Indicators of Compromise

• Unexpected crashes or aborts in processes linked against libpoppler when opening PDF files containing JBIG2 image streams
• PDF files whose JBIG2 segment headers declare abnormally large size fields near INT_MAX
• Elevated resource consumption or segmentation faults from document conversion services such as pdftoppm, pdftotext, or pdftocairo

Detection Strategies

• Inspect installed Poppler versions across endpoints and servers, flagging any host running 26.07.0 without the eb87cf7 patch applied
• Parse inbound PDF attachments at the mail gateway to identify JBIG2 code table segments with malformed length metadata
• Correlate crash telemetry from PDF-processing utilities with recent file opens to surface exploitation attempts

Monitoring Recommendations

• Enable core dump collection for document viewers and log analysis for SIGSEGV or SIGABRT events referencing JBIG2Stream.cc
• Track package inventory drift on Linux fleets to confirm distribution security updates for Poppler are received
• Monitor server-side PDF conversion queues for repeated failures on the same input file, which may indicate probing

How to Mitigate CVE-2026-93313

Immediate Actions Required

• Upgrade Poppler to a release incorporating commit eb87cf711563894649bd0c365baa479401dc6d51 from the upstream Freedesktop repository
• Rebuild and redeploy any applications that statically link the vulnerable Poppler version
• Restrict processing of untrusted PDFs by sandboxing viewers and conversion services until patches are applied

Patch Information

The fix is available in the Freedesktop Poppler project as commit eb87cf711563894649bd0c365baa479401dc6d51, merged through GitLab Poppler Merge Request 2322. Additional context is tracked in GitLab Poppler Work Item 1760 and the VulDB CVE-2026-93313 Details entry. Distribution maintainers should backport the patch to supported Poppler branches.

Workarounds

• Disable JBIG2 decoding in downstream applications where a build-time option is available
• Run PDF viewers under seccomp, AppArmor, or SELinux profiles to contain memory corruption
• Block inbound PDFs containing JBIG2 streams at the email or web proxy tier when patching is delayed