CVE-2026-107705
published 2026-10-08CVE-2026-107705: Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite…
PriorityP345medium6.5CVSS 3.1
AVNACHPRNUINSUCNILAH
EPSS
0.32%
25.2th percentile
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freedesktop | poppler | — | — |
| freedesktop | poppler | 0.42.0 – 26.10.0 | — |
| ubuntu | poppler | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
nvdv4.08.3HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
freedesktop Poppler up to 26.10.0 Decrypt Decrypt::revision6Hash buffer overflow (Nessus ID 364714 / WID-SEC-2026-3845)
vuldb·2026-10-13·CVSS 6.5
CVE-2026-107705 [MEDIUM] freedesktop Poppler up to 26.10.0 Decrypt Decrypt::revision6Hash buffer overflow (Nessus ID 364714 / WID-SEC-2026-3845)
A vulnerability has been found in freedesktop Poppler up to 26.10.0 and classified as critical. Affected is the function Decrypt::revision6Hash of the component Decrypt. This manipulation causes buffer overflow.
The identification of this vulnerability is CVE-2026-107705. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypt
ghsa_unreviewed·2026-10-08
CVE-2026-107705 [HIGH] CWE-121 Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypt
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
Ubuntu
poppler vulnerability
vendor_ubuntu·2026-10-21
CVE-2026-107705 poppler vulnerability
Title: poppler vulnerability
Summary: poppler could be made to crash if it opened a specially crafted file.
It was discovered that poppler incorrectly handled the password length
limit when decrypting certain encrypted PDF files. An attacker could
possibly use this issue to cause a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption
vendor_redhat·2026-10-08·CVSS 6.5
CVE-2026-107705 [MEDIUM] CWE-120 poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption
poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption
A flaw was found in Poppler. A stack-based buffer overflow vulnerability exists in the decryption routine when processing encrypted PDF documents. By providing an overly long password during document decryption, an attacker can overwrite memory buffers. This issue primarily leads to a Denial of Service (DoS) through application crashes, or potential memory corruption.
Package: poppler (Red Hat Enterprise Linux 10) - Fix deferred
Package: poppler (Red Hat Enterprise Linux 6) - Out of support scope
Package: compat-poppler022 (Red Hat Enterprise Linux 7) - Fix deferred
Package: poppler (Red Hat Enterprise Linux 7) - Fix deferred
Package: poppler (Red Hat Enterprise Linux 8) - Fix deferred
Package: pop
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-107705 poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption [fedora-all]
bugzilla·2026-10-09·CVSS 6.5
CVE-2026-107705 [MEDIUM] CVE-2026-107705 poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption [fedora-all]
CVE-2026-107705 poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
Bugzilla
CVE-2026-107705 mingw-poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption [fedora-all]
bugzilla·2026-10-09·CVSS 6.5
CVE-2026-107705 [MEDIUM] CVE-2026-107705 mingw-poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption [fedora-all]
CVE-2026-107705 mingw-poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
Bugzilla
CVE-2026-107705 poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption
bugzilla·2026-10-08·CVSS 6.5
CVE-2026-107705 [MEDIUM] CVE-2026-107705 poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption
CVE-2026-107705 poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
https://gitlab.freedesktop.org/poppler/popplerhttps://gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-26.10.0/poppler/Decrypt.cc#L1767https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash
2026-10-08
Published