CVE-2010-4654
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
CVE-2010-4654 is a high vulnerability (CVSS 7.8) in Freedesktop Poppler, published November 13, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in poppler 0.16.3-1.
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
- Record
CVE-2010-4654- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
- Record
CVE-2010-4654- Updated
- 2026-11-02
EUVDEUVD-2010-4619 No score
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
- Record
EUVD-2010-4619- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-366c-cfp4-w5fc No score
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
- Record
GHSA-366c-cfp4-w5fc- Updated
- 2026-11-02
OSV
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
- Record
CVE-2010-4654- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-4654
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
- Record
DEBIAN-CVE-2010-4654- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2010-4654
poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.
- Record
UBUNTU-CVE-2010-4654- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerDebian:12 |
before 0.16.3-1 | 0.16.3-1 |
popplerDebian:13 |
before 0.16.3-1 | 0.16.3-1 |
popplerDebian:14 |
before 0.16.3-1 | 0.16.3-1 |
ipeUbuntu:16.04:LTS |
All versions, plus listed versions 7.1.4-2.17.1.8-17.1.10-17.1.10-1.1 |
None known |
xpdfUbuntu:16.04:LTS |
All versions, plus listed versions 3.03-17ubuntu23.03-17ubuntu33.03-17ubuntu53.03-183.04-13.04-1build13.04-1ubuntu13.04-1ubuntu1.1 |
None known |
ipeUbuntu:18.04:LTS |
All versions, plus listed versions 7.2.7-27.2.7-3 |
None known |
ipeUbuntu:20.04:LTS |
All versions, plus listed versions 7.2.9-17.2.13-27.2.13-2build1 |
None known |
ipeUbuntu:22.04:LTS |
All versions, plus listed versions 7.2.23+dfsg1-27.2.24+dfsg1-17.2.24+dfsg1-1build1 |
None known |
ipeUbuntu:24.04:LTS |
All versions, plus listed versions 7.2.27+dfsg1-27.2.28-27.2.28-2.1build27.2.28-2.1build37.2.28-2.1build4 |
None known |
ipeUbuntu:25.10 |
All versions, plus listed versions 7.2.30-1build1 |
None known |
ipeUbuntu:26.10 |
All versions, plus listed versions 7.2.30-1build27.2.30-2 |
None known |
ipeUbuntu:26.04:LTS |
All versions, plus listed versions 7.2.30-1build17.2.30-1build2 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
security-tracker.debian.org/tracker/CVE-2010-4654
bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4654
access.redhat.com/security/cve/cve-2010-4654
security.gentoo.org/glsa/glsa-201310-03.xml
nvd.nist.gov/vuln/detail/CVE-2010-4654
github.com/advisories/GHSA-366c-cfp4-w5fc
ubuntu.com/security/CVE-2010-4654
thread.gmane.org/gmane.comp.security.oss.general/4109
cve.org/CVERecord?id=CVE-2010-4654