Medium severity · published Oct 8, 2026
CVE-2026-107705
Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
poppler · freedesktop
0.42.0 through 26.10.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107705
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107705
issue-tracking
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814
patch
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398
technical-description
https://gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-26.10.0/poppler/Decrypt.cc#L1767
product
https://gitlab.freedesktop.org/poppler/poppler
third-party-advisory
https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash
More from poppler
7.8
CVE-2021-30860
Apple Multiple Products Integer Overflow Vulnerability
9.8
CVE-2019-9631
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function
8.8
CVE-2018-21009
Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc
8.8
CVE-2019-12293
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths
8.8
CVE-2019-10872
An issue was discovered in Poppler 0.74.0