Every CVE Search/ Get API key

CVE-2018-21009

Poppler before 0.76.0 has an integer overflow in Parser::makeStream in Parser.cc.

8.8 HighFix available

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.89%Up 1.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

Record
CVE-2018-21009
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-190
Updated
2026-11-02
CVE List No score

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

Record
CVE-2018-21009
Updated
2026-11-02
EUVDEUVD-2018-13533 No score

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

Record
EUVD-2018-13533
Updated
2026-11-03
GitHub AdvisoriesGHSA-2x97-hfgj-7xpw No score

Poppler before 0.76.0 has an integer overflow in Parser::makeStream in Parser.cc.

Poppler before 0.76.0 has an integer overflow in Parser::makeStream in Parser.cc.

Record
GHSA-2x97-hfgj-7xpw
Updated
2026-11-02
OSV 8.8

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

Record
CVE-2018-21009
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-21009 8.8

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

Record
DEBIAN-CVE-2018-21009
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2020:1074 6.6

Red Hat Security Advisory: poppler and evince security update

Record
RHSA-2020:1074
CVSS 3.0
6.6 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-21009 8.8

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

Record
UBUNTU-CVE-2018-21009
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVSUSE-SU-2023:2838-1 No score

Security update for poppler

This update for poppler fixes the following issues:

  • CVE-2022-27337: Fixed a logic error in the Hints::Hints function which can cause denial of service (bsc#1199272).
  • CVE-2018-21009: Fixed integer overflow in Parser:makeStream in Parser.cc (bsc#1149635).
  • CVE-2019-12293: Fixed heap-based buffer over-read in JPXStream:init in JPEG2000Stream.cc (bsc#1136105).
Record
SUSE-SU-2023:2838-1
Updated
2026-11-02
OSVSUSE-SU-2023:2906-1 No score

Security update for poppler

This update for poppler fixes the following issues:

  • CVE-2022-27337: Fixed a logic error in the Hints::Hints function which can cause denial of service (bsc#1199272).
  • CVE-2018-21009: Fixed integer overflow in Parser:makeStream in Parser.cc (bsc#1149635).
  • CVE-2018-20481: Fixed memory leak in GfxColorSpace:setDisplayProfile in GfxState.cc (bsc#1114966).
  • CVE-2019-7310: Fixed a heap-based buffer over-read allows remote attackers to cause DOS via a special crafted PDF (bsc#1124150).
  • CVE-2018-13988: Fixed buffer overflow in pdfunite (bsc#1102531).
  • CVE-2018-16646: Fixed infinite recursion in poppler/Parser.cc:Parser::getObj() function (bsc#1107597).
  • CVE-2018-19058: Fixed reachable abort in Object.h leading to denial of service (bsc#1115187).
  • CVE-2018-19059: Fixed out-of-bounds read in EmbFile:save2 in FileSpec.cc leading to denial of service (bsc#1115186).
  • CVE-2018-19060: Fixed NULL pointer dereference in goo/GooString.h leading to denial of service (bsc#1115185).
  • CVE-2018-19149: Fixed NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment (bsc#1115626).
  • CVE-2017-18267: Fixed denial of service (infinite recursion) via a crafted PDF file (bsc#1092945).
  • CVE-2018-20650: Fixed issue where a reachable Object in dictLookup assertion allows attackers to cause DOS (bsc#1120939).
Record
SUSE-SU-2023:2906-1
Updated
2026-11-02
OSVSUSE-SU-2023:2907-1 No score

Security update for poppler

This update for poppler fixes the following issues:

  • CVE-2022-27337: Fixed a logic error in the Hints::Hints function which can cause denial of service (bsc#1199272).
  • CVE-2018-21009: Fixed integer overflow in Parser:makeStream in Parser.cc (bsc#1149635).
  • CVE-2019-12293: Fixed heap-based buffer over-read in JPXStream:init in JPEG2000Stream.cc (bsc#1136105).
  • CVE-2018-20481: Fixed memory leak in GfxColorSpace:setDisplayProfile in GfxState.cc (bsc#1114966).
  • CVE-2019-7310: Fixed a heap-based buffer over-read allows remote attackers to cause DOS via a special crafted PDF (bsc#1124150).
  • CVE-2018-13988: Fixed buffer overflow in pdfunite (bsc#1102531).
  • CVE-2018-16646: Fixed infinite recursion in poppler/Parser.cc:Parser::getObj() function (bsc#1107597).
  • CVE-2018-19058: Fixed reachable abort in Object.h leading to denial of service (bsc#1115187).
  • CVE-2018-19059: Fixed out-of-bounds read in EmbFile:save2 in FileSpec.cc leading to denial of service (bsc#1115186).
  • CVE-2018-19060: Fixed NULL pointer dereference in goo/GooString.h leading to denial of service (bsc#1115185).
  • CVE-2018-19149: Fixed NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment (bsc#1115626).
  • CVE-2017-18267: Fixed denial of service (infinite recursion) via a crafted PDF file (bsc#1092945).
  • CVE-2018-20650: Fixed issue where a reachable Object in dictLookup assertion allows attackers to cause DOS (bsc#1120939).
Record
SUSE-SU-2023:2907-1
Updated
2026-11-02
OSVUSN-4646-1 No score

poppler vulnerabilities

It was discovered that Poppler incorrectly handled certain files. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service.

Record
USN-4646-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
poppler
Debian:12
 before 0.69.0-2
0.69.0-2
poppler
Debian:13
 before 0.69.0-2
0.69.0-2
poppler
Debian:14
 before 0.69.0-2
0.69.0-2
poppler
Debian:8
 before 0.26.5-2+deb8u11, plus listed versions
0.26.5-20.26.5-2+deb8u10.26.5-2+deb8u100.26.5-2+deb8u1~bpo70+10.26.5-2+deb8u2
Show 7 moreShow less
0.26.5-2+deb8u30.26.5-2+deb8u40.26.5-2+deb8u50.26.5-2+deb8u60.26.5-2+deb8u70.26.5-2+deb8u80.26.5-2+deb8u9
0.26.5-2+deb8u11
poppler
Debian:9
 before 0.48.0-2+deb9u3, plus listed versions
0.48.0-20.48.0-2+deb9u10.48.0-2+deb9u2
0.48.0-2+deb9u3
evince
Red Hat:enterprise_linux:7::client
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-dvi
Red Hat:enterprise_linux:7::client
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-libs
Red Hat:enterprise_linux:7::client
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-nautilus
Red Hat:enterprise_linux:7::client
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
Show 70 moreShow less
Affected packages
PackageAffectedFixed
poppler
Red Hat:enterprise_linux:7::client
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-glib
Red Hat:enterprise_linux:7::client
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-qt
Red Hat:enterprise_linux:7::client
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-utils
Red Hat:enterprise_linux:7::client
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
evince-browser-plugin
Red Hat:enterprise_linux:7::client
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-devel
Red Hat:enterprise_linux:7::client
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
poppler-cpp
Red Hat:enterprise_linux:7::client
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-cpp-devel
Red Hat:enterprise_linux:7::client
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-demos
Red Hat:enterprise_linux:7::client
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-devel
Red Hat:enterprise_linux:7::client
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-glib-devel
Red Hat:enterprise_linux:7::client
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-qt-devel
Red Hat:enterprise_linux:7::client
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler
Red Hat:enterprise_linux:7::computenode
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-qt
Red Hat:enterprise_linux:7::computenode
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-utils
Red Hat:enterprise_linux:7::computenode
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-cpp
Red Hat:enterprise_linux:7::computenode
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-cpp-devel
Red Hat:enterprise_linux:7::computenode
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-demos
Red Hat:enterprise_linux:7::computenode
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-devel
Red Hat:enterprise_linux:7::computenode
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-glib
Red Hat:enterprise_linux:7::computenode
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-glib-devel
Red Hat:enterprise_linux:7::computenode
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-qt-devel
Red Hat:enterprise_linux:7::computenode
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
evince
Red Hat:enterprise_linux:7::server
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-dvi
Red Hat:enterprise_linux:7::server
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-libs
Red Hat:enterprise_linux:7::server
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-nautilus
Red Hat:enterprise_linux:7::server
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
poppler
Red Hat:enterprise_linux:7::server
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-glib
Red Hat:enterprise_linux:7::server
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-qt
Red Hat:enterprise_linux:7::server
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-utils
Red Hat:enterprise_linux:7::server
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
evince-browser-plugin
Red Hat:enterprise_linux:7::server
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-devel
Red Hat:enterprise_linux:7::server
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
poppler-cpp
Red Hat:enterprise_linux:7::server
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-cpp-devel
Red Hat:enterprise_linux:7::server
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-demos
Red Hat:enterprise_linux:7::server
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-devel
Red Hat:enterprise_linux:7::server
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-glib-devel
Red Hat:enterprise_linux:7::server
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-qt-devel
Red Hat:enterprise_linux:7::server
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
evince
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-dvi
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-libs
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-nautilus
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
poppler
Red Hat:enterprise_linux:7::workstation
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-glib
Red Hat:enterprise_linux:7::workstation
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-qt
Red Hat:enterprise_linux:7::workstation
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-utils
Red Hat:enterprise_linux:7::workstation
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
evince-browser-plugin
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
evince-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.2-9.el7
0:3.28.2-9.el7
poppler-cpp
Red Hat:enterprise_linux:7::workstation
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-cpp-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-demos
Red Hat:enterprise_linux:7::workstation
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-glib-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler-qt-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.26.5-42.el7
0:0.26.5-42.el7
poppler
openSUSE:Leap 15.4
 before 0.62.0-150000.4.15.1
0.62.0-150000.4.15.1
poppler
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 0.24.4-14.26.1
0.24.4-14.26.1
poppler
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 0.43.0-16.25.1
0.43.0-16.25.1
poppler-qt
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 0.43.0-16.25.1
0.43.0-16.25.1
poppler
SUSE:Linux Enterprise Server 12 SP5
 before 0.43.0-16.25.1
0.43.0-16.25.1
poppler-qt
SUSE:Linux Enterprise Server 12 SP5
 before 0.43.0-16.25.1
0.43.0-16.25.1
poppler
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.43.0-16.25.1
0.43.0-16.25.1
poppler-qt
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.43.0-16.25.1
0.43.0-16.25.1
poppler
Ubuntu:16.04:LTS
 before 0.41.0-0ubuntu1.15, plus listed versions
0.33.0-0ubuntu30.37.0-0ubuntu10.38.0-0ubuntu10.41.0-0ubuntu10.41.0-0ubuntu1.1
Show 13 moreShow less
0.41.0-0ubuntu1.20.41.0-0ubuntu1.30.41.0-0ubuntu1.40.41.0-0ubuntu1.50.41.0-0ubuntu1.60.41.0-0ubuntu1.70.41.0-0ubuntu1.80.41.0-0ubuntu1.90.41.0-0ubuntu1.100.41.0-0ubuntu1.110.41.0-0ubuntu1.120.41.0-0ubuntu1.130.41.0-0ubuntu1.14
0.41.0-0ubuntu1.15
poppler
Ubuntu:18.04:LTS
 before 0.62.0-2ubuntu2.11, plus listed versions
0.57.0-2ubuntu40.57.0-2ubuntu50.62.0-1ubuntu10.62.0-2ubuntu10.62.0-2ubuntu2
Show 9 moreShow less
0.62.0-2ubuntu2.10.62.0-2ubuntu2.20.62.0-2ubuntu2.40.62.0-2ubuntu2.50.62.0-2ubuntu2.60.62.0-2ubuntu2.70.62.0-2ubuntu2.80.62.0-2ubuntu2.90.62.0-2ubuntu2.10
0.62.0-2ubuntu2.11

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-21009 is a high vulnerability (CVSS 8.8) in Freedesktop Poppler, published September 5, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.89%, the 79th percentile. Fixed in poppler 0.69.0-2.

References

Show 59 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open