Login Request a demo
Medium severity · published Sep 18, 2026
CVE-2026-93314
Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Poppler · Freedesktop
26.07.0 · source: vendor
Affected product
PO
Poppler
Freedesktop
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93314
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93314
github.com
https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-mapCodeToGID-FoFiTrueType.cc-608.md
gitlab.freedesktop.org
https://gitlab.freedesktop.org/poppler/poppler/-/commit/ed2a5538cf0a8d3ff908191eda9b73f91a5f952a?merge_request_iid=2315
gitlab.freedesktop.org
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2315
gitlab.freedesktop.org
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1761
vuldb.com
https://vuldb.com/cve/CVE-2026-93314
vuldb.com
https://vuldb.com/submit/942347
More from Poppler
7.8
CVE-2021-30860
Apple Multiple Products Integer Overflow Vulnerability
9.8
CVE-2019-9631
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function
8.8
CVE-2018-21009
Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc
8.8
CVE-2019-12293
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths
8.8
CVE-2019-10872
An issue was discovered in Poppler 0.74.0