CVE-2026-107705: falha de alta gravidade em freedesktop poppler
Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.3epss 0.3%
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Produtos afetados
freedesktop · popplerReferências
https://gitlab.freedesktop.org/poppler/popplerhttps://gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-26.10.0/poppler/Decrypt.cc#L1767https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash