Vulnerability in freedesktop poppler

[ Description ]Official description

Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund8 Oct 2026WID-SEC-2026-3845

  poppler: Vulnerability allows denial of service and data manipulation Translated from German

  Risk highCVE-2026-107705

[ References ]References

• gitlab.freedesktop.org/poppler/poppler
• gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-26.10.0/poppler/Decrypt.cc
• gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398
• gitlab.freedesktop.org/poppler/poppler/-/work_items/1814
• www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-d…