CVE-2026-102621
Freedesktop Poppler SplashClip.cc clipToPath integer overflow
- State
- Published
- Severity
- 4.8 Medium
- Published
- Sep 29, 2026
- Updated
- Sep 30, 2026
- Reserved
- Sep 29, 2026
Description
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.3 Low | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 3.3 Low | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 1.7 Low | AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
PopplerFreedesktop |
|
References
- VDB-411411 | Freedesktop Poppler SplashClip.cc clipToPath integer overflowvdb-entrytechnical-description
- VDB-411411 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-102621 | CVE Analysis and Reportthird-party-advisory
- Submit #942349 | freedesktop.org Poppler 26.07.0 Integer Overflowthird-party-advisory
- https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1763related
- https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2325patch
- https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-SplashClip-clipToPath-SplashClip.cc-214.mdexploit
- https://gitlab.freedesktop.org/poppler/poppler/-/commit/323c91036d99926a8b90dc14329f7b40aece22f8patch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.