A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

AIONLYREPORT package: poppler-26.01.0-7.hum1 ------ Summary: Heap Buffer Overflow in tilingPatternFill via Integer Overflow: unchecked multiplication of tiling pattern dimensions in SplashOutputDev::tilingPatternFill can overflow signed image sizes, leading to an undersized heap allocation and a subsequent out-of-bounds write when a crafted PDF is rendered through Poppler's Splash backend. Requirements to exploit: The attacker must be able to supply a crafted PDF to an application that uses Poppler's Splash backend and cause it to be rendered. No privileges are required, but the malicious file must be opened or otherwise processed through the vulnerable rendering path. Component affected: poppler (Splash backend; poppler/SplashOutputDev.cc::tilingPatternFill / tilingBitmapSrc, with allocation reached through splash/Splash.cc) Version affected: 26.01.0 (confirmed by code inspection); other versions containing the same tilingPatternFill / tilingBitmapSrc logic may also be affected Patch available: no Version fixed (if any already): unknown Upstream coordination: Not yet notified. This report is the initial triage. CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - 7.8 (HIGH) AV:L - The attacker supplies a malicious local PDF that must be rendered by a vulnerable application. AC:L - No unusual conditions are required beyond reaching the Splash rendering path with crafted tiling parameters. PR:N - No privileges are required. UI:R - A user or service must open or render the PDF. S:U - Impact remains within the security scope of the vulnerable application process using Poppler. C:H - Successful exploitation could expose data available to the consuming application. I:H - Successful exploitation could allow modification or code execution in the context of the consuming application. A:H - Heap corruption can crash the renderer or otherwise disrupt availability. Impact: Likely Important. This is a heap-based memory-corruption issue in a document-rendering component. Rendering a malicious PDF can corrupt heap memory in the consuming application and may lead to code execution or compromise of confidentiality, integrity, and availability with that application's privileges. User interaction or document processing is required, so this does not rise to Critical. Embargo: yes Reason: This is a likely Important memory-corruption flaw in a widely used PDF rendering library, and no upstream fix is identified in the source report. Public disclosure before remediation would provide actionable exploit detail for malicious-document attacks. Acknowledgement: Aisle Research Steps to reproduce: 1. Build Poppler with AddressSanitizer enabled. 2. Open or render a crafted PDF containing a tiling pattern where (x1 - x0) and/or (y1 - y0) make repeatX / repeatY large enough for surfacewidth repeatX or surfaceheight repeatY to overflow a 32-bit signed int. 3. Trigger the Splash rendering path, for example: pdftoppm -f 1 -singlefile poctilingoverflow.pdf output-prefix 4. Observe AddressSanitizer reporting a heap out-of-bounds write in tilingBitmapSrc during drawImage processing.

Vulnerability Details

resultwidth and resultheight are computed using unchecked signed multiplication and then passed to drawImage(): cpp resultwidth = surfacewidth repeatX; resultheight = surfaceheight repeatY; ... retValue = splash->drawImage(&tilingBitmapSrc, nullptr, &imgData, colorMode, true, resultwidth, resultheight, matc, false, true) == splashOk; However, the source callback still writes based on repeatX and the tile width rather than the possibly overflowed resultwidth: cpp for (int m = 0; m < imgData->repeatX; m++) { for (int x = 0; x < imgData->bitmap->getWidth(); x++) { imgData->bitmap->getPixel(x, imgData->y, q); q += splashColorModeNComps[cMode]; } } drawImage() / scaleImage() allocate line buffers from the supplied width value: cpp lineBuf = (unsigned char )gmallocncheckoverflow(srcWidth, nComps); If surfacewidth repeatX overflows to a small positive value, the allocation becomes too small while tilingBitmapSrc still writes according to the larger repeat count, resulting in heap corruption. Relevant CWE IDs: CWE-190 (Integer Overflow or Wraparound)

CWE-122 / CWE-787 (Heap-based Buffer Overflow / Out-of-bounds Write)

Proposed Fix

Use checked arithmetic before dimension multiplication and avoid signed-overflow expressions in guards: diff diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc index XXXXXXX..YYYYYYY 100644 — a/poppler/SplashOutputDev.cc +++ b/poppler/SplashOutputDev.cc @@ -4342,7 +4342,13 @@ bool SplashOutputDev::tilingPatternFill(...) if (surfacewidth == 0 || surfaceheight == 0 || repeatX repeatY <= 4) { + int repeatArea = 0; + if (surfacewidth == 0 || surfaceheight == 0 || + checkedMultiply(repeatX, repeatY, &repeatArea) || + repeatArea <= 4) { state->setCTM(savedCTM[0], savedCTM[1], savedCTM[2], savedCTM[3], savedCTM[4], savedCTM[5]); return false; } @@ -4364,8 +4370,13 @@ bool SplashOutputDev::tilingPatternFill(...)

resultwidth = surfacewidth repeatX;

resultheight = surfaceheight repeatY; + if (checkedMultiply(surfacewidth, repeatX, &resultwidth) || + checkedMultiply(surfaceheight, repeatY, &resultheight) || + resultwidth <= 0 || resultheight <= 0) { + state->setCTM(savedCTM[0], savedCTM[1], savedCTM[2], savedCTM[3], savedCTM[4], savedCTM[5]); + return false; + } + kx = resultwidth / (fabs(kx) + 1); ky = resultheight / (fabs(ky) + 1);

------ This report was generated using AI technology. Always review AI-generated content prior to use

A use-after-free (write) vulnerability has been detected in Poppler within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a std::vector, which can lead to dangling pointers when the vector is resized.

A use-after-free (write) vulnerability has been detected in Poppler within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a std::vector, which can lead to dangling pointers when the vector is resized.

Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Because std::atomicint is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

poppler uses std::atomicint for reference counting. Because it is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free.

Last updated 8 April 2025

poppler git commit bf2055088a corrects a possible use of an uninitialized pointer in PostScriptFunction, which can cause crash or memory corruption.

Upstream git commit: http://cgit.freedesktop.org/poppler/poppler/commit/?id=bf2055088a3a2d3bb3d3c37d464954ec1a25771f

This problem does not affect xpdf or other applications embedding xpdf code. It only affects recent poppler versions, not before commit:

http://cgit.freedesktop.org/poppler/poppler/commit/?id=b1d4efb082ac3dadd7752a557e5aeb6651e17471

Reference: http://secunia.com/advisories/41596/

An array indexing error was found in the way xpdf / poppler parsed Type1 fonts embedded in PDF documents. In FoFiType1::parse(), text representation of the numeric code value was converted to integer value using atoi(). This value was checked to ensure it's less than 256, but there was no check to ensure it's not negative (string passed to atoi() was checked to only contain characters '0'-'9' before the call though). On platforms, where atoi() could return negative result when parsing large positive values (exceeding INTMAX), this could could lead to write out of array bounds due to use of negative index.

poppler upstream commit: http://cgit.freedesktop.org/poppler/poppler/commit/?id=39d140bfc0b8239bdd96d6a55842034ae5c05473

Reference: http://secunia.com/advisories/41596/

An array indexing error was found in the way xpdf / poppler parsed Type1 fonts embedded in PDF documents. In FoFiType1::parse(), text representation of the numeric code value was converted to integer value using atoi(). This value was checked to ensure it's less than 256, but there was no check to ensure it's not negative (string passed to atoi() was checked to only contain characters '0'-'9' before the call though). On platforms, where atoi() could return negative result when parsing large positive values (exceeding INTMAX), this could could lead to write out of array bounds due to use of negative index.

poppler upstream commit: http://cgit.freedesktop.org/poppler/poppler/commit/?id=39d140bfc0b8239bdd96d6a55842034ae5c05473

Reference: http://secunia.com/advisories/41596/

Multiple integer overflows in Poppler 0.10.5 and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file, related to (1) glib/poppler-page.cc; (2) ArthurOutputDev.cc, (3) CairoOutputDev.cc, (4) GfxState.cc, (5) JBIG2Stream.cc, (6) PSOutputDev.cc, and (7) SplashOutputDev.cc in poppler/; and (8) SplashBitmap.cc, (9) Splash.cc, and (10) SplashFTFont.cc in splash/. NOTE: this may overlap CVE-2009-0791.

Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "gallocn."

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers an out-of-bounds read.

Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.

A security flaw was found in the JBIG2 decoder (possibility of freeing of uninitialized memory). An attacker could use this flaw to potentially cause a denial of service (application crash).

Acknowledgements:

Red Hat would like to thank Braden Thomas and Drew Yao of the Apple Product Security team for responsibly reporting this flaw.

The JBIG2Stream::readSymbolDictSeg function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file that triggers a parsing error, which is not properly handled by JBIG2SymbolDict::~JBIG2SymbolDict and triggers an invalid memory dereference.

The FormWidgetChoice::loadDefaults function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file with an invalid Form Opt entry.

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.

The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.