CVE-2026-93312
published 2026-09-18CVE-2026-93312: A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes…
PriorityP421medium4.3CVSS 3.1
AVNACLPRNUIRSUCNINAL
EPSS
0.40%
34.4th percentile
A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freedesktop | poppler | — | — |
| freedesktop | poppler | — | — |
| ubuntu | poppler | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat4.3MEDIUM
vendor_ubuntu3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw has been found in Freedesktop Poppler 26.07.0.
ghsa_unreviewed·2026-09-18
CVE-2026-93312 [LOW] CWE-404 A flaw has been found in Freedesktop Poppler 26.07.0.
A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.
Ubuntu
poppler vulnerabilities
vendor_ubuntu·2026-10-07·CVSS 3.3
CVE-2026-93314 [LOW] poppler vulnerabilities
Title: poppler vulnerabilities
Summary: poppler could be made to crash or run programs as your login if it
opened a specially crafted file.
It was discovered that Poppler had an integer overflow in
FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to
cause Poppler to crash, resulting in a denial of service, or execute
arbitrary code.
(CVE-2026-102620)
It was discovered that Poppler had an integer overflow in
SplashClip::clipToPath. An attacker could possibly use this issue to
cause Poppler to crash, resulting in a denial of service, or execute
arbitrary code.
(CVE-2026-102621)
It was discovered that Poppler had a null pointer dereference in
JBIG2Stream. An attacker could possibly use this issue to cause
Poppler to crash, resulting in a denial of service.
(CVE-2026-93312
Red Hat
poppler: Freedesktop Poppler: Denial of Service via null pointer dereference in JBIG2Stream::rewind function
vendor_redhat·2026-09-18·CVSS 4.3
CVE-2026-93312 [MEDIUM] CWE-476 poppler: Freedesktop Poppler: Denial of Service via null pointer dereference in JBIG2Stream::rewind function
poppler: Freedesktop Poppler: Denial of Service via null pointer dereference in JBIG2Stream::rewind function
A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.
A flaw was found in Freedesktop Poppler. A remote attacker could exploit a null pointer dereference vulnerability in the `JBIG2Stream::rewind` function. This could lead to a denial of service (DoS), making the application unavailable to legi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/r1ck9-2q/cve_summit/blob/main/Null-pointer-offset-undefined-behavior-in-JBIG2Stream-rewind-JBIG2Stream.cc-1229.mdhttps://gitlab.freedesktop.org/poppler/poppler/-/commit/5e49250f13b0390edeb3f90eb4c02c9941f97067https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2314https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1759https://vuldb.com/cve/CVE-2026-93312https://vuldb.com/submit/942345https://vuldb.com/vuln/406610https://vuldb.com/vuln/406610/ctihttps://gitlab.freedesktop.org/poppler/poppler/-/work_items/1759https://vuldb.com/submit/942345
2026-09-18
Published