Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-93312 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CNA: [email protected]CVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1759	CISA-ADP	Issue TrackingTechnical DescriptionVendor
https://vuldb.com/submit/942345	CISA-ADP	Permission Required
https://github.com/r1ck9-2q/cve_summit/blob/main/Null-pointer-offset-undefined-behavior-in-JBIG2Stream-rewind-JBIG2Stream.cc-1229.md	[email protected]	ExploitTechnical Analysis
https://gitlab.freedesktop.org/poppler/poppler/-/commit/5e49250f13b0390edeb3f90eb4c02c9941f97067	[email protected]	Source CodeVendor
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2314	[email protected]	Issue TrackingVendor
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1759	[email protected]	Issue TrackingTechnical DescriptionVendor
https://vuldb.com/cve/CVE-2026-93312	[email protected]	AdvisoryPermission Required
https://vuldb.com/submit/942345	[email protected]	Permission Required
https://vuldb.com/vuln/406610	[email protected]	Permission Required
https://vuldb.com/vuln/406610/cti	[email protected]	Content Wall

see all 10 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-404	Improper Resource Shutdown or Release	[email protected]
CWE-476	NULL Pointer Dereference	[email protected]

Affected Products

Product	Versions
Freedesktop Poppler	26.07.0 (semver)
CPE cpe:2.3:a:freedesktop:poppler:::::::: Remediation Upgrade: 26.08.0moderate effort Workaround:low effort Do not open PDF files from untrusted sources. Workaround:low effort Process untrusted PDF files in a sandboxed/containerized environment.

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 22, 2026	CVE Modified	CISA-ADP
Sep 18, 2026	New CVE Received	[email protected]