CVE-2026-102621
Freedesktop Poppler SplashClip.cc clipToPath integer overflow
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Freedesktop Poppler SplashClip.cc clipToPath integer overflow
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
- Record
CVE-2026-102621- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C - CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C - CVSS 2.0
- 1.7
AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C - Weakness
- CWE-190, CWE-189
- Updated
- 2026-11-02
EUVDEUVD-2026-89437
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
- Record
EUVD-2026-89437- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fxmp-c8v9-778f
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function...
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
- Record
GHSA-fxmp-c8v9-778f- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
NVD
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
- Record
CVE-2026-102621- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 1.7 Low
AV:L/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-189, CWE-190
- Updated
- 2026-11-02
OSV
Freedesktop Poppler SplashClip.cc clipToPath integer overflow
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
- Record
CVE-2026-102621- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-189, CWE-190
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-102621
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
- Record
DEBIAN-CVE-2026-102621- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2026:74469
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:74469- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-102621
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
- Record
UBUNTU-CVE-2026-102621- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11968-1 No score
libpoppler-cpp3-26.09.0-3.1 on GA media
These are all security issues fixed in the libpoppler-cpp3-26.09.0-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11968-1- Updated
- 2026-11-02
OSVUSN-8894-1 No score
poppler vulnerabilities
It was discovered that Poppler had an integer overflow in FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-102620)
It was discovered that Poppler had an integer overflow in SplashClip::clipToPath. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-102621)
It was discovered that Poppler had a null pointer dereference in JBIG2Stream. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service. (CVE-2026-93312)
It was discovered that Poppler had an integer overflow in JBIG2Stream::readCodeTableSeg. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93313)
It was discovered that Poppler had an integer overflow in FoFiTrueType::mapCodeToGID. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93314)
- Record
USN-8894-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerDebian:12 |
All versions, plus listed versions 22.12.0-222.12.0-2+deb12u122.12.0-2+deb12u222.12.0-2+deb12u322.12.0-2.1 Show 41 moreShow less22.12.0-2.223.08.0-123.08.0-223.12.0-124.02.0-124.02.0-224.02.0-324.02.0-424.02.0-524.02.0-5+loong6424.06.0-124.06.0-224.08.0-124.08.0-224.08.0-324.08.0-425.01.0-125.01.0-225.01.0-325.01.0-425.01.0-525.03.0-125.03.0-1025.03.0-1125.03.0-11.125.03.0-225.03.0-325.03.0-425.03.0-525.03.0-625.03.0-725.03.0-926.01.0-126.01.0-226.01.0-326.01.0-426.01.0-4.126.01.0-526.07.0-126.07.0-226.07.0-3 |
None known |
popplerDebian:13 |
All versions, plus listed versions 25.03.0-1025.03.0-1125.03.0-11.125.03.0-525.03.0-5+deb13u2 Show 14 moreShow less25.03.0-5+deb13u325.03.0-5+deb13u425.03.0-625.03.0-725.03.0-926.01.0-126.01.0-226.01.0-326.01.0-426.01.0-4.126.01.0-526.07.0-126.07.0-226.07.0-3 |
None known |
popplerDebian:14 |
before 26.07.0-3, plus listed versions 25.03.0-1025.03.0-1125.03.0-11.125.03.0-525.03.0-6 Show 10 moreShow less25.03.0-725.03.0-926.01.0-126.01.0-226.01.0-326.01.0-426.01.0-4.126.01.0-526.07.0-126.07.0-2 |
26.07.0-3 |
popplerRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:26.08.0-1.2.hum1 | 0:26.08.0-1.2.hum1 |
poppler-cppRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:26.08.0-1.2.hum1 | 0:26.08.0-1.2.hum1 |
poppler-cpp-develRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:26.08.0-1.2.hum1 | 0:26.08.0-1.2.hum1 |
poppler-develRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:26.08.0-1.2.hum1 | 0:26.08.0-1.2.hum1 |
poppler-glibRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:26.08.0-1.2.hum1 | 0:26.08.0-1.2.hum1 |
poppler-glib-develRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:26.08.0-1.2.hum1 | 0:26.08.0-1.2.hum1 |
poppler-glib-docRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:26.08.0-1.2.hum1 | 0:26.08.0-1.2.hum1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
poppler-qt6Red Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:26.08.0-1.2.hum1 | 0:26.08.0-1.2.hum1 |
poppler-qt6-develRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:26.08.0-1.2.hum1 | 0:26.08.0-1.2.hum1 |
poppler-utilsRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:26.08.0-1.2.hum1 | 0:26.08.0-1.2.hum1 |
popplerUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.33.0-0ubuntu30.37.0-0ubuntu10.38.0-0ubuntu10.41.0-0ubuntu10.41.0-0ubuntu1.1 Show 23 moreShow less0.41.0-0ubuntu1.20.41.0-0ubuntu1.30.41.0-0ubuntu1.40.41.0-0ubuntu1.50.41.0-0ubuntu1.60.41.0-0ubuntu1.70.41.0-0ubuntu1.80.41.0-0ubuntu1.90.41.0-0ubuntu1.100.41.0-0ubuntu1.110.41.0-0ubuntu1.120.41.0-0ubuntu1.130.41.0-0ubuntu1.140.41.0-0ubuntu1.150.41.0-0ubuntu1.160.41.0-0ubuntu1.16+esm10.41.0-0ubuntu1.16+esm20.41.0-0ubuntu1.16+esm30.41.0-0ubuntu1.16+esm40.41.0-0ubuntu1.16+esm50.41.0-0ubuntu1.16+esm60.41.0-0ubuntu1.16+esm70.41.0-0ubuntu1.16+esm8 |
None known |
popplerUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.57.0-2ubuntu40.57.0-2ubuntu50.62.0-1ubuntu10.62.0-2ubuntu10.62.0-2ubuntu2 Show 21 moreShow less0.62.0-2ubuntu2.10.62.0-2ubuntu2.20.62.0-2ubuntu2.40.62.0-2ubuntu2.50.62.0-2ubuntu2.60.62.0-2ubuntu2.70.62.0-2ubuntu2.80.62.0-2ubuntu2.90.62.0-2ubuntu2.100.62.0-2ubuntu2.110.62.0-2ubuntu2.120.62.0-2ubuntu2.130.62.0-2ubuntu2.140.62.0-2ubuntu2.14+esm10.62.0-2ubuntu2.14+esm20.62.0-2ubuntu2.14+esm30.62.0-2ubuntu2.14+esm40.62.0-2ubuntu2.14+esm50.62.0-2ubuntu2.14+esm60.62.0-2ubuntu2.14+esm70.62.0-2ubuntu2.14+esm8 |
None known |
popplerUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 0.80.0-0ubuntu10.80.0-0ubuntu30.80.0-0ubuntu40.80.0-0ubuntu50.85.0-1ubuntu1 Show 12 moreShow less0.85.0-1ubuntu30.86.1-0ubuntu10.86.1-0ubuntu1.10.86.1-0ubuntu1.20.86.1-0ubuntu1.30.86.1-0ubuntu1.40.86.1-0ubuntu1.50.86.1-0ubuntu1.60.86.1-0ubuntu1.70.86.1-0ubuntu1.7+esm10.86.1-0ubuntu1.7+esm20.86.1-0ubuntu1.7+esm3 |
None known |
popplerUbuntu:22.04:LTS |
before 22.02.0-2ubuntu0.14, plus listed versions 21.06.1-121.11.0-1~ubuntu222.02.0-222.02.0-2ubuntu0.122.02.0-2ubuntu0.2 Show 11 moreShow less22.02.0-2ubuntu0.322.02.0-2ubuntu0.422.02.0-2ubuntu0.522.02.0-2ubuntu0.622.02.0-2ubuntu0.722.02.0-2ubuntu0.822.02.0-2ubuntu0.922.02.0-2ubuntu0.1022.02.0-2ubuntu0.1122.02.0-2ubuntu0.1222.02.0-2ubuntu0.13 |
22.02.0-2ubuntu0.14 |
popplerUbuntu:24.04:LTS |
before 24.02.0-1ubuntu9.10, plus listed versions 23.08.0-2ubuntu123.12.0-1ubuntu224.02.0-1ubuntu224.02.0-1ubuntu824.02.0-1ubuntu9 Show 9 moreShow less24.02.0-1ubuntu9.124.02.0-1ubuntu9.224.02.0-1ubuntu9.324.02.0-1ubuntu9.424.02.0-1ubuntu9.524.02.0-1ubuntu9.624.02.0-1ubuntu9.724.02.0-1ubuntu9.824.02.0-1ubuntu9.9 |
24.02.0-1ubuntu9.10 |
popplerUbuntu:26.04:LTS |
before 26.01.0-2ubuntu0.2, plus listed versions 25.03.0-1025.03.0-11.126.01.0-2build226.01.0-2ubuntu0.1 |
26.01.0-2ubuntu0.2 |
popplerUbuntu:22.04:LTS From an advisory covering 5 CVEs |
before 22.02.0-2ubuntu0.14, plus listed versions 21.06.1-121.11.0-1~ubuntu222.02.0-222.02.0-2ubuntu0.122.02.0-2ubuntu0.2 Show 11 moreShow less22.02.0-2ubuntu0.322.02.0-2ubuntu0.422.02.0-2ubuntu0.522.02.0-2ubuntu0.622.02.0-2ubuntu0.722.02.0-2ubuntu0.822.02.0-2ubuntu0.922.02.0-2ubuntu0.1022.02.0-2ubuntu0.1122.02.0-2ubuntu0.1222.02.0-2ubuntu0.13 |
22.02.0-2ubuntu0.14 |
popplerUbuntu:24.04:LTS From an advisory covering 5 CVEs |
before 24.02.0-1ubuntu9.10, plus listed versions 23.08.0-2ubuntu123.12.0-1ubuntu224.02.0-1ubuntu224.02.0-1ubuntu824.02.0-1ubuntu9 Show 9 moreShow less24.02.0-1ubuntu9.124.02.0-1ubuntu9.224.02.0-1ubuntu9.324.02.0-1ubuntu9.424.02.0-1ubuntu9.524.02.0-1ubuntu9.624.02.0-1ubuntu9.724.02.0-1ubuntu9.824.02.0-1ubuntu9.9 |
24.02.0-1ubuntu9.10 |
popplerUbuntu:26.04:LTS From an advisory covering 5 CVEs |
before 26.01.0-2ubuntu0.2, plus listed versions 25.03.0-1025.03.0-11.126.01.0-2build226.01.0-2ubuntu0.1 |
26.01.0-2ubuntu0.2 |
poppleropenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 26.09.0-3.1 | 26.09.0-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-102621 is a medium vulnerability (CVSS 4.8) in Freedesktop Poppler, published September 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in poppler 26.07.0-3.
References
vuldb.com/vuln/411411
gitlab.freedesktop.org/poppler/poppler/-/work_items/1763
Show 33 moreShow less
github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-SplashClip-clipToPath-SplashClip.cc-214.md
nvd.nist.gov/vuln/detail/CVE-2026-102621
security-tracker.debian.org/tracker/CVE-2026-102621
access.redhat.com/errata/RHSA-2026:74469
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74469.json
bugzilla.redhat.com/show_bug.cgi?id=2543645
cve.org/CVERecord?id=CVE-2026-102620
ubuntu.com/security/CVE-2026-102621
suse.com/security/cve/CVE-2026-102620