CVE-2026-107705

A flaw was found in Poppler. A stack-based buffer overflow vulnerability exists in the decryption routine when processing encrypted PDF documents. By providing an overly long password during document decryption, an attacker can overwrite memory buffers. This issue primarily leads to a Denial of Service (DoS) through application crashes, or potential memory corruption.

This vulnerability is rated as Moderate severity because successful exploitation requires user interaction to open an untrusted, password-protected PDF file while supplying an excessively long password. Although stack memory is overwritten during hash computation, default toolchain hardening on Red Hat Enterprise Linux restricts the impact primarily to client application crashes and denial of service. Furthermore, automated server environments rarely process attacker-supplied interactive passwords for encrypted documents.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.