A tiling pattern overflows an allocation in poppler's Splash renderer
A flaw was found in Poppler's Splash backend.
- Advisory
- CVE-2026-10118
- Library
- poppler, poppler on Debian
- Published
- Severity
- 7.8 out of 10, as published
- Affected
- poppler, as packaged; see the upstream record
- Fixed in
- see the upstream record
- Reaches you
- by opening a file
What triggers it
Rendering a PDF page whose tiling pattern makes tilingPatternFill compute an undersized allocation.
What sillybos does
Needs decoding to detect
The flaw is in the pixel data or the compressed stream, which only a decoder can see. Nothing before the decoder can refuse it; updating the decoder is the fix.
In the renderer's pattern filling; the pattern is page content that no header or pdfinfo report shows. Out of a pre-decode check's reach.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade poppler to a version that has the fix; the upstream record names it.
Specifically. Render PDFs in a boxed process with memory and time limits (see Decoding in a box); nothing read before decoding can see this.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2026-10118
- The record entry, triaged 2026-11-03, last checked 2026-11-03