CVE-2026-10118Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

Descripción

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• RHSA-2026:24984 vendor-advisory
• RHSA-2026:24985 vendor-advisory
• RHSA-2026:25058 vendor-advisory
• RHSA-2026:27720 vendor-advisory
• RHSA-2026:27721 vendor-advisory
• RHSA-2026:27722 vendor-advisory
• RHSA-2026:27723 vendor-advisory
• RHSA-2026:27724 vendor-advisory
• RHSA-2026:27725 vendor-advisory
• RHSA-2026:27727 vendor-advisory
• RHSA-2026:29952 vendor-advisory
• RHSA-2026:30044 vendor-advisory
• RHSA-2026:30078 vendor-advisory
• RHSA-2026:30087 vendor-advisory
• RHSA-2026:30088 vendor-advisory
• RHSA-2026:30089 vendor-advisory
• RHSA-2026:30134 vendor-advisory
• RHSA-2026:74674 vendor-advisory
• https://access.redhat.com/security/cve/CVE-2026-10118 vdb-entry
• RHBZ#2460428 issue-tracking
• https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10118.json