Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

Summary

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

Timeline

1. Jun 1, 2026, 3:33 PM UTCCVE published
2. Jun 2, 2026, 12:00 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 2, 2026, 2:06 AM UTCRecord last updated

Affected versions

• poppler

  Version range not reported

• poppler

  Version range not reported

• compat-poppler022

  Version range not reported

• poppler

  Version range not reported

• poppler

  Version range not reported

• poppler

  Version range not reported

• poppler

  Version range not reported

• poppler

  Version range not reported

• poppler

  Version range not reported

• poppler

  Version range not reported

• poppler

  Version range not reported

• poppler

  Version range not reported

• poppler

  Version range not reported

• poppler

  Version range not reported

• poppler

  Version range not reported

• rhaiis/model-opt-cuda-rhel9

  Version range not reported

• rhaiis/vllm-spyre-rhel9

  Version range not reported

• rhaiis/vllm-rocm-rhel9

  Version range not reported

• rhaiis/vllm-cuda-rhel9

  Version range not reported

• poppler-main

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• poppler

  Version range not reported

References 21