CVE-2026-93313 Details

A signed integer overflow vulnerability has been identified in Freedesktop Poppler version 26.07.0, specifically within the JBIG2Stream component. The issue arises in the readCodeTableSeg function, where the library processes JBIG2 Huffman code table segments. The vulnerability can be exploited remotely by manipulating PDF files to include attacker-controlled values that trigger the overflow. When the function reads a value of INT_MIN (-2147483648) from the JBIG2 segment data, the subsequent operation of subtracting one causes an overflow, leading to undefined behavior. This flaw has been publicly disclosed and could be exploited in the wild.

Users are advised to apply the upstream fix available in Poppler commit eb87cf71, which addresses the integer overflow by adding a range check before the subtraction operation. This fix has not yet been included in a official release version, so users should track the next Poppler release or build from source with the fix applied.