Home / mailings

PDF

[USN-8894-1] poppler vulnerabilities

Posted on 07 October 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8894-1
October 07, 2026

poppler vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

poppler could be made to crash or run programs as your login if it
opened a specially crafted file.

Software Description:
- poppler: PDF rendering library

Details:

It was discovered that Poppler had an integer overflow in
FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to
cause Poppler to crash, resulting in a denial of service, or execute
arbitrary code.
(CVE-2026-102620)

It was discovered that Poppler had an integer overflow in
SplashClip::clipToPath. An attacker could possibly use this issue to
cause Poppler to crash, resulting in a denial of service, or execute
arbitrary code.
(CVE-2026-102621)

It was discovered that Poppler had a null pointer dereference in
JBIG2Stream. An attacker could possibly use this issue to cause
Poppler to crash, resulting in a denial of service.
(CVE-2026-93312)

It was discovered that Poppler had an integer overflow in
JBIG2Stream::readCodeTableSeg. An attacker could possibly use this
issue to cause Poppler to crash, resulting in a denial of service,
or execute arbitrary code.
(CVE-2026-93313)

It was discovered that Poppler had an integer overflow in
FoFiTrueType::mapCodeToGID. An attacker could possibly use this
issue to cause Poppler to crash, resulting in a denial of service,
or execute arbitrary code.
(CVE-2026-93314)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
libpoppler156 26.01.0-2ubuntu0.2

Ubuntu 24.04 LTS
libpoppler134 24.02.0-1ubuntu9.10

Ubuntu 22.04 LTS
libpoppler118 22.02.0-2ubuntu0.14

In general, a standard system update will make all the necessary
changes.

References:
https://ubuntu.com/security/notices/USN-8894-1
CVE-2026-102620, CVE-2026-102621, CVE-2026-93312, CVE-2026-93313,
CVE-2026-93314

Package Information:
https://launchpad.net/ubuntu/+source/poppler/26.01.0-2ubuntu0.2
https://launchpad.net/ubuntu/+source/poppler/24.02.0-1ubuntu9.10
https://launchpad.net/ubuntu/+source/poppler/22.02.0-2ubuntu0.14

--===============7724064137784225798==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP