REDHAT-BUG-2537005: Medium severity Poppler Poppler vulnerability
A flaw was found in Poppler's Splash backend. In SplashOutputDev::tilingPatternFill (poppler/SplashOutputDev.cc), when a PDF's tiling pattern geometry (fill rectangle and step) drives the computed repeat count for the pattern-fill loop, the raw, PDF-controlled span (x1 - x0 / y1 - y0) is substituted directly into repeatX/repeatY whenever it exceeds the value derived from the (possibly overflowed) surface dimensions. This allows an attacker-supplied PDF to set repeatX/repeatY to a value bounded only by INTMAX (~2^31), which then drives an unconditional, unclipped loop in the tilingBitmapSrc scanline callback that executes once per output scanline. Because the source tile bitmap itself remains tiny, memory usage stays flat while the process consumes 100% CPU for an extended period, resulting in denial of service. This is a residual, distinct consequence of the same tilingPatternFill arithmetic defect addressed by CVE-2026-10118: the checkedMultiply() guard added by that fix only rejects requests where surfacewidth repeatX (or surfaceheight repeatY) would overflow an int; it does not bound repeatX/repeatY to a sane value when the product happens to fit under INTMAX, which is exactly the case exploited here. Confirmed reproducible on poppler 26.04.0, 26.06.0 (the CVE-2026-10118 fixed release), 26.08.0, and current master via an ~820-byte crafted PDF; verified against upstream source for all three references. Any application using Poppler's Splash backend to render untrusted PDFs (pdftoppm, document preview, mail-gateway attachment scanning, OCR pipelines) can be pinned to one CPU core per submitted file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
popplerto a version that resolves this vulnerability.Fixed in 26.04.0 - Upgrade
Upgrade
popplerto a version that resolves this vulnerability.Fixed in 26.06.0Patch CVE-2026-10118 - Upgrade
Upgrade
popplerto a version that resolves this vulnerability.Fixed in 26.08.0 - Compensating control
When rendering untrusted PDFs with Poppler (pdftoppm, document preview, mail-gateway attachment scanning, OCR pipelines), isolate/limit the rendering process (e.g., run in a sandbox/container with CPU/compute limits) to mitigate the per-file CPU pinning/DoS described for the Splash backend.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Deployments that render attacker-controlled PDFs using Poppler's Splash backend are exposed. The affected rendering path is the tiling-pattern fill processing in SplashOutputDev.
What does an attacker need to trigger the issue?
An attacker needs to supply a PDF containing tiling-pattern geometry that causes extremely large computed repeat counts. The resulting scanline callback loop can consume 100% CPU for an extended period while memory usage remains flat.
Does the checkedMultiply() protection associated with CVE-2026-10118 prevent this behavior?
Not in every case. That guard rejects cases where the surface dimension multiplied by the repeat count overflows an int, but it does not impose a reasonable upper bound on repeatX or repeatY when the product remains within INT_MAX.