CVE-2026-102620

A flaw was found in Poppler. An integer overflow vulnerability in the TrueType font handling code can allow a local user to cause data corruption. By providing a specially crafted font file processed by the FoFiTrueType::cvtSfnts function, an attacker can cause improper data modification and unexpected application behavior.

This flaw is rated as Moderate severity because exploitation requires processing a specially crafted font file or document and only results in data corruption within converted PostScript streams, without causing service crashes or unauthorized code execution. In Red Hat Enterprise Linux, Poppler is integrated as a shared library utilized by desktop document viewers and printing subsystems. Because the defect does not breach confidentiality or disrupt application availability, the overall risk to system operations remains limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.