CVE-2026-102621

Deferred Deferred - Pending Action

Integer Overflow in Poppler PDF Library

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: VulDB

Description

A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102621

EUVD

EUVD-2026-89437

Affected Vendors & Products

Vendor	Product	Version / Range
freedesktop	poppler	to 26.08.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-189
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow issue in Freedesktop Poppler up to version 26.08.0. It occurs in the SplashClip::clipToPath function of the file splash/SplashClip.cc. The flaw allows manipulation that leads to an integer overflow, which can be exploited locally.

Detection Guidance

Since this vulnerability is in Freedesktop Poppler and requires local access, detection involves checking the installed version of Poppler. Run 'pdftotext -v' or 'pdfinfo -v' to check the version. If it is below 26.09.0, the system is vulnerable.

Impact Analysis

The vulnerability can cause denial of service or potentially allow local attackers to execute arbitrary code. Since the exploit is publicly available, the risk of exploitation is higher. Upgrading to version 26.09.0 or applying the patch 323c91036d99926a8b90dc14329f7b40aece22f8 mitigates this issue.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a local integer overflow issue with low impact (availability only) and requires local access. No evidence suggests it affects data confidentiality or integrity.

Mitigation Strategies

Upgrade Freedesktop Poppler to version 26.09.0 or later. Apply the patch with hash 323c91036d99926a8b90dc14329f7b40aece22f8. Ensure no older versions remain installed to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-102621. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70