CVE-2026-102620

Deferred Deferred - Pending Action

Integer Overflow in Freedesktop Poppler

Publication date: 2026-09-29

Last updated on: 2026-10-02

Assigner: VulDB

Description

A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102620

Affected Vendors & Products

Vendor	Product	Version / Range
freedesktop	poppler	to 26.08.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-189
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This is an integer overflow vulnerability in Freedesktop Poppler versions 26.06.0, 26.07.0, and 26.08.0. It occurs in the FoFiTrueType::cvtSfnts function of the file fofi/FoFiTrueType.cc. The issue allows local attackers to manipulate the system due to improper handling of integer values.

Detection Guidance

This vulnerability can only be exploited locally and requires access to the affected Poppler library. Detection involves checking the installed version of Poppler against the vulnerable versions (26.06.0, 26.07.0, 26.08.0). Use commands like 'pdftotext -v' or 'apt list --installed | grep poppler' to verify the version.

Impact Analysis

Since the attack requires local access, it may allow attackers to execute arbitrary code or cause denial of service on affected systems. However, the impact is limited due to the local nature of the exploit and the low CVSS scores indicating minimal severity.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability involves a local integer overflow in Poppler, which may lead to limited integrity issues but lacks details on data exposure or privacy violations required for compliance assessments.

Mitigation Strategies

Install the provided patch 245d3c6823377755f2c1d5fdddd010279c6ed94d to address the integer overflow vulnerability in Freedesktop Poppler.

Hi! I’m here to help you understand CVE-2026-102620. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70