Log in Start free

Vulnerability · Published Sep 29, 2026 · Assigned by VulDB

CVE-2026-102621Freedesktop Poppler SplashClip.cc clipToPath integer overflow

Low 3.3

In plain English

A low-severity integer overflow in Poppler from Freedesktop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.1%top 98.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12popplerno fix listedDEBIAN-CVE-2026-102621
Debian:13popplerno fix listedDEBIAN-CVE-2026-102621
Debian:14poppler26.07.0-3DEBIAN-CVE-2026-102621
Ubuntu:22.04:LTSpoppler22.02.0-2ubuntu0.14USN-8894-1
Ubuntu:22.04:LTSpoppler22.02.0-2ubuntu0.14UBUNTU-CVE-2026-102621
Ubuntu:24.04:LTSpoppler24.02.0-1ubuntu9.10USN-8894-1
Ubuntu:24.04:LTSpoppler24.02.0-1ubuntu9.10UBUNTU-CVE-2026-102621
Ubuntu:26.04:LTSpoppler26.01.0-2ubuntu0.2UBUNTU-CVE-2026-102621
Ubuntu:26.04:LTSpoppler26.01.0-2ubuntu0.2USN-8894-1

Affected products (as reported)

VendorProductVersions
Freedesktop Poppler 26.08

Weakness: CWE-190, CWE-189 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References