CVE-2026-93311
poppler: Freedesktop Poppler: Denial of service via integer overflow in SampledFunction
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 18, 2026
Updated · October 14, 2026
Description
A flaw was found in Freedesktop Poppler. A remote attacker could exploit an integer overflow vulnerability by manipulating the BitsPerSample argument within the SampledFunction::SampledFunction function. This manipulation could lead to an integer overflow, potentially causing a denial of service (DoS) condition in the affected component.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
To mitigate this Moderate impact denial of service vulnerability in Poppler, users should avoid opening or processing untrusted PDF documents. For applications that integrate Poppler for PDF rendering, consider running them within a sandboxed environment to restrict potential exploit impact. No specific configuration changes are available to prevent this flaw without impacting functionality.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-190 · Integer Overflow or Wraparound