CVE catalog

CVE-2026-107705

Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypt

[CVE catalog]

Severity
High · CVSS 8.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpopplersid26.07.0-3vulnerable
Debianpopplerforky26.07.0-3vulnerable
Debianpopplertrixie25.03.0-5+deb13u4vulnerable
Debianpopplertrixie-security25.03.0-5+deb13u3vulnerable
Debianpopplerbookworm22.12.0-2+deb12u2vulnerable
Debianpopplerbookworm-security22.12.0-2+deb12u3vulnerable
Ubuntupopplernoble24.02.0-1ubuntu9.11fixed
Ubuntugir1.2-poppler-0.18noble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler-cpp-devnoble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler-cpp0t64noble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler-devnoble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler-glib-devnoble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler-glib-docnoble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler-glib8t64noble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler-private-devnoble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler-qt5-1t64noble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler-qt5-devnoble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler-qt6-3t64noble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler-qt6-devnoble24.02.0-1ubuntu9.11fixed
Ubuntulibpoppler134noble24.02.0-1ubuntu9.11fixed
Ubuntupoppler-utilsnoble24.02.0-1ubuntu9.11fixed
Ubuntupoppler22.0421.06.1-1vulnerable
Ubuntupoppler22.0421.11.0-1~ubuntu2vulnerable
Ubuntupoppler22.0422.02.0-2vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.1vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.2vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.3vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.4vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.5vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.6vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.7vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.8vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.9vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.10vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.11vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.12vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.13vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.14vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.15fixed
Ubuntupoppler24.0423.08.0-2ubuntu1vulnerable
Ubuntupoppler24.0423.12.0-1ubuntu2vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu2vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu8vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.1vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.2vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.3vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.4vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.5vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.6vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.7vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.8vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.9vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.10vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.11fixed
Ubuntupoppler26.1026.01.0-2build2vulnerable
Ubuntupoppler26.1026.01.0-5vulnerable
Ubuntupoppler26.1026.07.0-0ubuntu1vulnerable
Ubuntupoppler26.1026.07.0-2vulnerable
Ubuntupoppler26.1026.07.0-2ubuntu1vulnerable
Ubuntupoppler26.1026.07.0-2ubuntu1.1fixed
Ubuntupoppler26.0425.03.0-10vulnerable
Ubuntupoppler26.0425.03.0-11.1vulnerable
Ubuntupoppler26.0426.01.0-2build2vulnerable
Ubuntupoppler26.0426.01.0-2ubuntu0.1vulnerable
Ubuntupoppler26.0426.01.0-2ubuntu0.2vulnerable
Ubuntupoppler26.0426.01.0-2ubuntu0.3fixed
Ubuntupopplerpro0.80.0-0ubuntu1vulnerable
Ubuntupopplerpro0.80.0-0ubuntu3vulnerable
Ubuntupopplerpro0.80.0-0ubuntu4vulnerable
Ubuntupopplerpro0.80.0-0ubuntu5vulnerable
Ubuntupopplerpro0.85.0-1ubuntu1vulnerable
Ubuntupopplerpro0.85.0-1ubuntu3vulnerable
Ubuntupopplerpro0.86.1-0ubuntu1vulnerable
Ubuntupopplerpro0.86.1-0ubuntu1.1vulnerable
Ubuntupopplerpro0.86.1-0ubuntu1.2vulnerable
Ubuntupopplerpro0.86.1-0ubuntu1.3vulnerable
Ubuntupopplerpro0.86.1-0ubuntu1.4vulnerable
Ubuntupopplerpro0.86.1-0ubuntu1.5vulnerable
Ubuntupopplerpro0.86.1-0ubuntu1.6vulnerable
Ubuntupopplerpro0.86.1-0ubuntu1.7vulnerable
Ubuntupopplerpro0.86.1-0ubuntu1.7+esm1vulnerable
Ubuntupopplerpro0.86.1-0ubuntu1.7+esm2vulnerable
Ubuntupopplerpro0.86.1-0ubuntu1.7+esm3vulnerable
Ubuntupoppler22.0421.06.1-1vulnerable
Ubuntupoppler22.0421.11.0-1~ubuntu2vulnerable
Ubuntupoppler22.0422.02.0-2vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.1vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.2vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.3vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.4vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.5vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.6vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.7vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.8vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.9vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.10vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.11vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.12vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.13vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.14vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.15fixed
Ubuntupoppler24.0423.08.0-2ubuntu1vulnerable
Ubuntupoppler24.0423.12.0-1ubuntu2vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu2vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu8vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.1vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.2vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.3vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.4vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.5vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.6vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.7vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.8vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.9vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.10vulnerable
Ubuntupoppler24.0424.02.0-1ubuntu9.11fixed
Ubuntupoppler26.1026.01.0-2build2vulnerable
Ubuntupoppler26.1026.01.0-5vulnerable
Ubuntupoppler26.1026.07.0-0ubuntu1vulnerable
Ubuntupoppler26.1026.07.0-2vulnerable
Ubuntupoppler26.1026.07.0-2ubuntu1vulnerable
Ubuntupoppler26.1026.07.0-2ubuntu1.1fixed
Ubuntupoppler26.0425.03.0-10vulnerable
Ubuntupoppler26.0425.03.0-11.1vulnerable
Ubuntupoppler26.0426.01.0-2build2vulnerable
Ubuntupoppler26.0426.01.0-2ubuntu0.1vulnerable
Ubuntupoppler26.0426.01.0-2ubuntu0.2vulnerable
Ubuntupoppler26.0426.01.0-2ubuntu0.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpopplersourcesid(unfixed)not yet assignedNot reported[1150515]
Debianpopplersourceforky(unfixed)not yet assignedNot reported[1150515]
Debianpopplersourcetrixie(unfixed)not yet assignedNot reported[1150515]
Debianpopplersourcebookworm(unfixed)not yet assignedNot reported[1150515]
Ubuntupopplerdebnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntugir1.2-poppler-0.18debnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler-cpp-devdebnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler-cpp0t64debnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler-devdebnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler-glib-devdebnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler-glib-docdebnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler-glib8t64debnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler-private-devdebnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler-qt5-1t64debnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler-qt5-devdebnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler-qt6-3t64debnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler-qt6-devdebnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntulibpoppler134debnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntupoppler-utilsdebnoble24.02.0-1ubuntu9.11Not reportedNot reportedNot reported
Ubuntupopplerdeb22.0422.02.0-2ubuntu0.15Not reportedUSN-8950-1Not reported
Ubuntupopplerdeb24.0424.02.0-1ubuntu9.11Not reportedUSN-8950-1Not reported
Ubuntupopplerdeb26.1026.07.0-2ubuntu1.1Not reportedUSN-8950-1Not reported
Ubuntupopplerdeb26.0426.01.0-2ubuntu0.3Not reportedUSN-8950-1Not reported
Ubuntupopplerdeb22.0422.02.0-2ubuntu0.15Not reportedUBUNTU-CVE-2026-107705Not reported
Ubuntupopplerdeb24.0424.02.0-1ubuntu9.11Not reportedUBUNTU-CVE-2026-107705Not reported
Ubuntupopplerdeb26.1026.07.0-2ubuntu1.1Not reportedUBUNTU-CVE-2026-107705Not reported
Ubuntupopplerdeb26.0426.01.0-2ubuntu0.3Not reportedUBUNTU-CVE-2026-107705Not reported

[Debian bug #1150515]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • [libpoppler126]Affected

    Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • [libpoppler-dev]Affected

    Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · all · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · all · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · all · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · all · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

  • [poppler-utils]Affected

    Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · poppler · debian · bookworm

Observed:

References