CVE catalog

CVE-2026-102621

A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The

[CVE catalog]

Severity: Low · CVSS 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Published: Sep 18, 2026, 1:16:56 AM UTC
Updated: Sep 29, 2026, 10:17:07 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.11% · Oct 25, 2026

A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	poppler	sid	`26.07.0-3`	fixed
Debian	poppler	forky	`26.07.0-3`	fixed
Debian	poppler	trixie	`25.03.0-5+deb13u4`	vulnerable
Debian	poppler	trixie-security	`25.03.0-5+deb13u3`	vulnerable
Debian	poppler	bookworm	`22.12.0-2+deb12u2`	vulnerable
Debian	poppler	bookworm-security	`22.12.0-2+deb12u3`	vulnerable
Ubuntu	poppler	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	gir1.2-poppler-0.18	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler-cpp-dev	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler-cpp0t64	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler-dev	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler-glib-dev	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler-glib-doc	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler-glib8t64	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler-private-dev	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler-qt5-1t64	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler-qt5-dev	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler-qt6-3t64	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler-qt6-dev	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	libpoppler134	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	poppler-utils	noble	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	poppler	pro	`0.80.0-0ubuntu1`	vulnerable
Ubuntu	poppler	pro	`0.80.0-0ubuntu3`	vulnerable
Ubuntu	poppler	pro	`0.80.0-0ubuntu4`	vulnerable
Ubuntu	poppler	pro	`0.80.0-0ubuntu5`	vulnerable
Ubuntu	poppler	pro	`0.85.0-1ubuntu1`	vulnerable
Ubuntu	poppler	pro	`0.85.0-1ubuntu3`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.1`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.2`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.3`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.4`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.5`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.6`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7+esm1`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7+esm2`	vulnerable
Ubuntu	poppler	pro	`0.86.1-0ubuntu1.7+esm3`	vulnerable
Ubuntu	poppler	22.04	`21.06.1-1`	vulnerable
Ubuntu	poppler	22.04	`21.11.0-1~ubuntu2`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.1`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.2`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.3`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.4`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.5`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.6`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.7`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.8`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.9`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.10`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.11`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.12`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.13`	vulnerable
Ubuntu	poppler	22.04	`22.02.0-2ubuntu0.14`	fixed
Ubuntu	poppler	24.04	`23.08.0-2ubuntu1`	vulnerable
Ubuntu	poppler	24.04	`23.12.0-1ubuntu2`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu2`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu8`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.1`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.2`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.3`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.4`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.5`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.6`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.7`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.8`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.9`	vulnerable
Ubuntu	poppler	24.04	`24.02.0-1ubuntu9.10`	fixed
Ubuntu	poppler	26.04	`25.03.0-10`	vulnerable
Ubuntu	poppler	26.04	`25.03.0-11.1`	vulnerable
Ubuntu	poppler	26.04	`26.01.0-2build2`	vulnerable
Ubuntu	poppler	26.04	`26.01.0-2ubuntu0.1`	vulnerable
Ubuntu	poppler	26.04	`26.01.0-2ubuntu0.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	poppler	source	sid	`26.07.0-3`	not yet assigned	Not reported	[1149698]
Debian	poppler	source	forky	`26.07.0-3`	not yet assigned	Not reported	[1149698]
Debian	poppler	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1149698]
Debian	poppler	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1149698]
Ubuntu	poppler	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	gir1.2-poppler-0.18	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler-cpp-dev	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler-cpp0t64	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler-dev	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler-glib-dev	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler-glib-doc	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler-glib8t64	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler-private-dev	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler-qt5-1t64	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler-qt5-dev	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler-qt6-3t64	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler-qt6-dev	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	libpoppler134	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	poppler-utils	deb	noble	`24.02.0-1ubuntu9.10`	Not reported	Not reported	Not reported
Ubuntu	poppler	deb	22.04	`22.02.0-2ubuntu0.14`	Not reported	UBUNTU-CVE-2026-102621	Not reported
Ubuntu	poppler	deb	24.04	`24.02.0-1ubuntu9.10`	Not reported	UBUNTU-CVE-2026-102621	Not reported
Ubuntu	poppler	deb	26.04	`26.01.0-2ubuntu0.2`	Not reported	UBUNTU-CVE-2026-102621	Not reported

[Debian bug #1149698]

Notes

[trixie] poppler: Minor issue [bookworm] poppler: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-poppler-0.18]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler126]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler-cpp0v5]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler-cpp-dev]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler-dev]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler-glib8]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler-glib-dev]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler-glib-doc]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · all · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · all · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · all · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · all · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler-private-dev]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler-qt5-1]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler-qt5-dev]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler-qt6-3]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[libpoppler-qt6-dev]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
[poppler-utils]Affected
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · poppler · debian · bookworm; nvd · poppler · debian · 12

[Debian 13 (Trixie)]

[gir1.2-poppler-0.18]Affected
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  nvd · poppler · debian · 13
[libpoppler147]Affected
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  nvd · poppler · debian · 13
[libpoppler-cpp2]Affected
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  nvd · poppler · debian · 13
[libpoppler-cpp-dev]Affected
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  nvd · poppler · debian · 13
[libpoppler-dev]Affected
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  nvd · poppler · debian · 13
[libpoppler-glib8t64]Affected
Source package: [poppler]
Details (4)
- 25.03.0-5+deb13u4 · amd64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u4 · arm64 · trixie
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · amd64 · trixie-security
  Affected
  nvd · poppler · debian · 13
- 25.03.0-5+deb13u3 · arm64 · trixie-security
  Affected
  nvd · poppler · debian · 13

Next results

Observed: Oct 27, 2026, 5:44:28 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]