CVE-2026-93314: Freedesktop Poppler Integer Overflow RCE Vulnerability

CVE-2026-93314 Overview

CVE-2026-93314 is an integer overflow vulnerability in Freedesktop Poppler 26.07.0. The flaw resides in the FoFiTrueType::mapCodeToGID function within fofi/FoFiTrueType.cc. An attacker can trigger the overflow by manipulating the segCnt argument during TrueType font processing. The issue is classified under [CWE-189] (Numeric Errors) and requires user interaction to exploit, typically by opening a crafted PDF document containing a malicious embedded font. A public exploit disclosure exists, and upstream maintainers have released a fix identified by commit hash ed2a5538cf0a8d3ff908191eda9b73f91a5f952a.

Critical Impact
Remote attackers can trigger a signed integer overflow in Poppler's TrueType font parser through crafted PDF files, potentially causing memory corruption or denial of service in applications that link against the library.

Affected Products

Freedesktop Poppler version 26.07.0
Applications embedding vulnerable Poppler builds (PDF viewers, converters, and rendering pipelines)
Linux desktop environments and server workflows that process untrusted PDF files with Poppler

Discovery Timeline

2026-09-18 - CVE-2026-93314 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93314

Vulnerability Analysis

The vulnerability exists in Poppler's font handling subsystem, specifically the FoFiTrueType::mapCodeToGID routine responsible for mapping character codes to glyph identifiers in TrueType fonts. When parsing font data, the function operates on the segCnt argument that describes the segment count in the font's character-to-glyph index mapping table.

Insufficient bounds checking on segCnt allows attacker-controlled values to overflow signed integer arithmetic. The overflow can bypass subsequent size validations and lead to out-of-bounds memory access or incorrect loop behavior during glyph resolution. Applications that render or convert attacker-supplied PDF files inherit this exposure.

Root Cause

The root cause is unchecked arithmetic on a signed integer derived from font table data ([CWE-189]). The parser trusts segCnt when computing offsets and buffer sizes, but does not validate that intermediate calculations remain within representable integer bounds before use.

Attack Vector

Exploitation is remote but requires user interaction. An attacker delivers a PDF containing a malformed embedded TrueType font. When the victim opens the file with a Poppler-based viewer such as Evince, Okular, or a command-line utility like pdftoppm, the malicious font triggers the overflow in mapCodeToGID. The public disclosure referenced in the GitHub CVE Analysis documents the vulnerable code path at line 608 of FoFiTrueType.cc.

See the GitLab Merge Request for the upstream fix and validation logic added by the maintainers.

Detection Methods for CVE-2026-93314

Indicators of Compromise

Unexpected crashes or aborts in processes linking libpoppler when opening PDF files
PDF documents with malformed or oversized TrueType font tables sourced from untrusted origins
Core dumps referencing FoFiTrueType::mapCodeToGID or nearby symbols in fofi/FoFiTrueType.cc

Detection Strategies

Inventory installed Poppler packages across Linux endpoints and compare against version 26.07.0
Scan software composition manifests for applications statically linking vulnerable Poppler builds
Enable AddressSanitizer or similar instrumentation in test environments to surface overflow behavior when processing suspicious PDFs

Monitoring Recommendations

Alert on repeated crashes of PDF rendering processes such as evince, okular, pdftoppm, or pdftotext
Monitor mail and file-sharing gateways for PDFs with embedded fonts flagged by document sanitization tools
Correlate endpoint telemetry for abnormal child processes spawned by PDF viewers following document open events

How to Mitigate CVE-2026-93314

Immediate Actions Required

Apply the upstream Poppler patch identified by commit ed2a5538cf0a8d3ff908191eda9b73f91a5f952a
Update Poppler to a distribution build that incorporates the fix once available from your Linux vendor
Restrict processing of PDFs from untrusted sources on servers and shared workstations

Patch Information

The fix is available in the upstream Poppler repository as commit ed2a5538cf0a8d3ff908191eda9b73f91a5f952a, merged via GitLab Merge Request 2315. Additional context is tracked in GitLab Work Item 1761. Rebuild any application that statically links Poppler after applying the patch.

Workarounds

Sandbox PDF viewers using tools such as Firejail, bubblewrap, or systemd service hardening to limit blast radius
Route inbound PDFs through a content disarm and reconstruction pipeline that strips embedded fonts before delivery
Disable automatic PDF preview in mail clients and file managers until patched Poppler builds are deployed

bash

# Verify installed Poppler version on Debian/Ubuntu
dpkg -l | grep -i poppler

# Verify installed Poppler version on RHEL/Fedora
rpm -qa | grep -i poppler

# Rebuild Poppler from source with the upstream fix
git clone https://gitlab.freedesktop.org/poppler/poppler.git
cd poppler
git checkout ed2a5538cf0a8d3ff908191eda9b73f91a5f952a
mkdir build && cd build
cmake .. && make -j$(nproc) && sudo make install