CVE-2026-93313
published 2026-09-18CVE-2026-93313: A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file…
PriorityP336medium6.3CVSS 3.1
AVNACLPRNUIRSUCLILAL
EPSS
0.24%
14.8th percentile
A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freedesktop | poppler | — | — |
| freedesktop | poppler | — | — |
| ubuntu | poppler | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat6.3MEDIUM
vendor_ubuntu3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
poppler vulnerabilities
vendor_ubuntu·2026-10-07·CVSS 3.3
CVE-2026-93314 [LOW] poppler vulnerabilities
Title: poppler vulnerabilities
Summary: poppler could be made to crash or run programs as your login if it
opened a specially crafted file.
It was discovered that Poppler had an integer overflow in
FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to
cause Poppler to crash, resulting in a denial of service, or execute
arbitrary code.
(CVE-2026-102620)
It was discovered that Poppler had an integer overflow in
SplashClip::clipToPath. An attacker could possibly use this issue to
cause Poppler to crash, resulting in a denial of service, or execute
arbitrary code.
(CVE-2026-102621)
It was discovered that Poppler had a null pointer dereference in
JBIG2Stream. An attacker could possibly use this issue to cause
Poppler to crash, resulting in a denial of service.
(CVE-2026-93312
Red Hat
poppler: Poppler: Remote integer overflow vulnerability
vendor_redhat·2026-09-18·CVSS 6.3
CVE-2026-93313 [MEDIUM] CWE-190 poppler: Poppler: Remote integer overflow vulnerability
poppler: Poppler: Remote integer overflow vulnerability
A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch.
A flaw was found in Poppler. This vulnerability, an integer overflow, occurs within the `JBIG2Stream::readCodeTableSeg` function when processing specially crafted JBIG2 image data. A remote attacker could exploit this by providing specially crafted input, which may lead to memory corruption. This could result in a den
GHSA
A vulnerability was found in Freedesktop Poppler 26.07.0.
ghsa_unreviewed·2026-09-18
CVE-2026-93313 [LOW] A vulnerability was found in Freedesktop Poppler 26.07.0.
A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-JBIG2Stream-readCodeTableSeg-JBIG2Stream.cc-4118.mdhttps://gitlab.freedesktop.org/poppler/poppler/-/commit/eb87cf711563894649bd0c365baa479401dc6d51?merge_request_iid=2322https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2322https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1760https://vuldb.com/cve/CVE-2026-93313https://vuldb.com/submit/942346https://vuldb.com/vuln/406612https://vuldb.com/vuln/406612/cti
2026-09-18
Published