← CVE Intelligence

CVE-2026-10118

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication PUBLISHED

Description (CNA)

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Enterprise Linux 10unaffected 0:24.02.0-7.el10_2.2 before *
Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Supportunaffected 0:24.02.0-7.el10_0.1 before *
Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:0.22.5-7.el7_9 before *
Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:0.26.5-44.el7_9 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 0:20.11.0-14.el8_10 before *
Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:20.11.0-2.el8_4.3 before *
Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 0:20.11.0-2.el8_4.3 before *
Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:20.11.0-5.el8_6.1 before *
Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onunaffected 0:20.11.0-5.el8_6.1 before *
Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceunaffected 0:20.11.0-7.el8_8.1 before *
Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsunaffected 0:20.11.0-7.el8_8.1 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:21.01.0-24.el9_8.1 before *
Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:21.01.0-15.el9_2.1 before *
Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutionsunaffected 0:21.01.0-20.el9_4.1 before *
Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Supportunaffected 0:21.01.0-22.el9_6.1 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1782352950 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1782352919 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1782353093 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1782352847 before *
Red Hat / Red Hat Hardened Imagesunaffected 26.06.0-0.1.hum1 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1790703542 before *
Red Hat / Red Hat Enterprise Linux 6unaffected

CWE

CWE-190

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.