CVE-2026-93314
published 2026-09-18CVE-2026-93314: A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing…
PriorityP335medium6.3CVSS 3.1
AVNACLPRNUIRSUCLILAL
EPSS
0.24%
14.8th percentile
A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freedesktop | poppler | — | — |
| freedesktop | poppler | — | — |
| ubuntu | poppler | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat6.3MEDIUM
vendor_ubuntu3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
poppler vulnerabilities
vendor_ubuntu·2026-10-07·CVSS 3.3
CVE-2026-93314 [LOW] poppler vulnerabilities
Title: poppler vulnerabilities
Summary: poppler could be made to crash or run programs as your login if it
opened a specially crafted file.
It was discovered that Poppler had an integer overflow in
FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to
cause Poppler to crash, resulting in a denial of service, or execute
arbitrary code.
(CVE-2026-102620)
It was discovered that Poppler had an integer overflow in
SplashClip::clipToPath. An attacker could possibly use this issue to
cause Poppler to crash, resulting in a denial of service, or execute
arbitrary code.
(CVE-2026-102621)
It was discovered that Poppler had a null pointer dereference in
JBIG2Stream. An attacker could possibly use this issue to cause
Poppler to crash, resulting in a denial of service.
(CVE-2026-93312
Red Hat
poppler: Poppler: Remote integer overflow vulnerability
vendor_redhat·2026-09-18·CVSS 6.3
CVE-2026-93314 [MEDIUM] CWE-190 poppler: Poppler: Remote integer overflow vulnerability
poppler: Poppler: Remote integer overflow vulnerability
A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.
A flaw was found in Poppler. A remote attacker could exploit an integer overflow vulnerability by manipulating the `segCnt` argument within the `FoFiTrueType::mapCodeToGID` function. This could potentially lead to information disclosure, data corruption, or denial of service.
Mitigation: To
GHSA
A vulnerability was determined in Freedesktop Poppler 26.07.0.
ghsa_unreviewed·2026-09-18
CVE-2026-93314 [LOW] A vulnerability was determined in Freedesktop Poppler 26.07.0.
A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-mapCodeToGID-FoFiTrueType.cc-608.mdhttps://gitlab.freedesktop.org/poppler/poppler/-/commit/ed2a5538cf0a8d3ff908191eda9b73f91a5f952a?merge_request_iid=2315https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2315https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1761https://vuldb.com/cve/CVE-2026-93314https://vuldb.com/submit/942347https://vuldb.com/vuln/406613https://vuldb.com/vuln/406613/cti
2026-09-18
Published