Login Request a demo
Medium severity · published Sep 18, 2026
CVE-2026-93313
Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Poppler · Freedesktop
26.07.0 · source: vendor
Affected product
PO
Poppler
Freedesktop
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93313
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93313
github.com
https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-JBIG2Stream-readCodeTableSeg-JBIG2Stream.cc-4118.md
gitlab.freedesktop.org
https://gitlab.freedesktop.org/poppler/poppler/-/commit/eb87cf711563894649bd0c365baa479401dc6d51?merge_request_iid=2322
gitlab.freedesktop.org
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2322
gitlab.freedesktop.org
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1760
vuldb.com
https://vuldb.com/cve/CVE-2026-93313
vuldb.com
https://vuldb.com/submit/942346
More from Poppler
7.8
CVE-2021-30860
Apple Multiple Products Integer Overflow Vulnerability
9.8
CVE-2019-9631
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function
8.8
CVE-2018-21009
Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc
8.8
CVE-2019-12293
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths
8.8
CVE-2019-10872
An issue was discovered in Poppler 0.74.0