Tetrak
GitHub ↗
Security · poppler

Converting an embedded TrueType font overflows an integer in poppler

A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0.

Advisory
CVE-2026-102620
Library
poppler, poppler on Debian
Published
Severity
not scored upstream
Affected
poppler 26.06.0 through 26.08.0
Fixed in
see the upstream record
Reaches you
by opening a file

What triggers it

Rendering a PDF whose embedded TrueType font makes FoFiTrueType::cvtSfnts overflow.

What sillybos does

Needs decoding to detect

The flaw is in the pixel data or the compressed stream, which only a decoder can see. Nothing before the decoder can refuse it; updating the decoder is the fix.

Reached by rendering, through an embedded TrueType font that poppler converts, as CVE-2026-93314; nothing is filtered. Embedded fonts are not unusual: every searchable PDF carries one for its text layer, Tetrak OCR's own output included (all thirty-eight PDFs in its checkouts), so a policy refusing fonts, which pdffonts could support, would refuse the very files the check exists to protect. A flaw in the font program, in poppler's own parser here is out of this library's reach; the boxed process is the defence.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Moved from B2 to C on 2026-11-02, with the finding above.

How to protect yourself

In general. Upgrade poppler to a version that has the fix; the upstream record names it.

Specifically. Render in a boxed process.

The general advice applies to every row here.

Sources