CVE-2026-107705 Details
Description
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
A stack-based buffer overflow vulnerability has been identified in Poppler versions 0.42.0 through 26.10.0. The issue arises in the Decrypt::revision6Hash() function, where attackers can exploit the vulnerability by supplying a password longer than 127 bytes when opening AESV3/R6 encrypted PDFs. This overflow allows for the K1 and E buffers to be overwritten, potentially crashing the process or corrupting memory. The vulnerability can be exploited through applications that use libpoppler, libpoppler-glib, or the C++ API.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.freedesktop.org/poppler/poppler | [email protected] | Permission RequiredVendor |
| https://gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-26.10.0/poppler/Decrypt.cc#L1767 | [email protected] | Source CodeVendor |
| https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Poppler | >= 0.42.0, <= 26.10.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |