Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-08T19:51:12 poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-120

Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.

A flaw was found in Poppler. A stack-based buffer overflow vulnerability exists in the decryption routine when processing encrypted PDF documents. By providing an overly long password during document decryption, an attacker can overwrite memory buffers. This issue primarily leads to a Denial of Service (DoS) through application crashes, or potential memory corruption.

This vulnerability is rated as Moderate severity because successful exploitation requires user interaction to open an untrusted, password-protected PDF file while supplying an excessively long password. Although stack memory is overwritten during hash computation, default toolchain hardening on Red Hat Enterprise Linux restricts the impact primarily to client application crashes and denial of service. Furthermore, automated server environments rarely process attacker-supplied interactive passwords for encrypted documents. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Hardened Images 2026-10-09T00:00:00Z RHSA-2026:80172 poppler-main-26.08.0-1.3.hum1 Red Hat Hardened Images 2026-10-12T00:00:00Z RHSA-2026:80579 poppler-main-26.08.0-1.4.hum1 Red Hat Enterprise Linux 10 Fix deferred poppler Red Hat Enterprise Linux 6 Not affected poppler Red Hat Enterprise Linux 7 Not affected compat-poppler022 Red Hat Enterprise Linux 7 Not affected poppler Red Hat Enterprise Linux 8 Fix deferred poppler Red Hat Enterprise Linux 9 Fix deferred poppler https://www.cve.org/CVERecord?id=CVE-2026-107705 https://nvd.nist.gov/vuln/detail/CVE-2026-107705 https://gitlab.freedesktop.org/poppler/poppler https://gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-26.10.0/poppler/Decrypt.cc#L1767 https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398 https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814 https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash