CVE-2026-102620: Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow
A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Freedesktop Popplerto a version that resolves this vulnerability.Patch 245d3c6823377755f2c1d5fdddd010279c6ed94d
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Only local attackers can exploit it, and exploitation requires low privileges. Systems running the affected Poppler versions are the relevant exposure scope; no remote attack path is described.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used, which increases the practical importance of applying the available fix despite the low severity rating.
What should be done to remediate the vulnerability?
Install the patch identified as 245d3c6823377755f2c1d5fdddd010279c6ed94d. The provided data does not specify an alternative mitigation if patching cannot be performed immediately.