PDFunite 0.41.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by processing malformed PDF files during merge operations. Attackers can trigger a segmentation fault in the XRef::getEntry function within libpoppler by providing a specially crafted PDF file to the pdfunite utility.

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the tilingPatternFill function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

AIONLYREPORT package: poppler-26.01.0-7.hum1 ------ Summary: Heap Buffer Overflow in tilingPatternFill via Integer Overflow: unchecked multiplication of tiling pattern dimensions in SplashOutputDev::tilingPatternFill can overflow signed image sizes, leading to an undersized heap allocation and a subsequent out-of-bounds write when a crafted PDF is rendered through Poppler's Splash backend. Requirements to exploit: The attacker must be able to supply a crafted PDF to an application that uses Poppler's Splash backend and cause it to be rendered. No privileges are required, but the malicious file must be opened or otherwise processed through the vulnerable rendering path. Component affected: poppler (Splash backend; poppler/SplashOutputDev.cc::tilingPatternFill / tilingBitmapSrc, with allocation reached through splash/Splash.cc) Version affected: 26.01.0 (confirmed by code inspection); other versions containing the same tilingPatternFill / tilingBitmapSrc logic may also be affected Patch available: no Version fixed (if any already): unknown Upstream coordination: Not yet notified. This report is the initial triage. CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - 7.8 (HIGH) AV:L - The attacker supplies a malicious local PDF that must be rendered by a vulnerable application. AC:L - No unusual conditions are required beyond reaching the Splash rendering path with crafted tiling parameters. PR:N - No privileges are required. UI:R - A user or service must open or render the PDF. S:U - Impact remains within the security scope of the vulnerable application process using Poppler. C:H - Successful exploitation could expose data available to the consuming application. I:H - Successful exploitation could allow modification or code execution in the context of the consuming application. A:H - Heap corruption can crash the renderer or otherwise disrupt availability. Impact: Likely Important. This is a heap-based memory-corruption issue in a document-rendering component. Rendering a malicious PDF can corrupt heap memory in the consuming application and may lead to code execution or compromise of confidentiality, integrity, and availability with that application's privileges. User interaction or document processing is required, so this does not rise to Critical. Embargo: yes Reason: This is a likely Important memory-corruption flaw in a widely used PDF rendering library, and no upstream fix is identified in the source report. Public disclosure before remediation would provide actionable exploit detail for malicious-document attacks. Acknowledgement: Aisle Research Steps to reproduce: 1. Build Poppler with AddressSanitizer enabled. 2. Open or render a crafted PDF containing a tiling pattern where (x1 - x0) and/or (y1 - y0) make repeatX / repeatY large enough for surfacewidth repeatX or surfaceheight repeatY to overflow a 32-bit signed int. 3. Trigger the Splash rendering path, for example: pdftoppm -f 1 -singlefile poctilingoverflow.pdf output-prefix 4. Observe AddressSanitizer reporting a heap out-of-bounds write in tilingBitmapSrc during drawImage processing.

Vulnerability Details

resultwidth and resultheight are computed using unchecked signed multiplication and then passed to drawImage(): cpp resultwidth = surfacewidth repeatX; resultheight = surfaceheight repeatY; ... retValue = splash->drawImage(&tilingBitmapSrc, nullptr, &imgData, colorMode, true, resultwidth, resultheight, matc, false, true) == splashOk; However, the source callback still writes based on repeatX and the tile width rather than the possibly overflowed resultwidth: cpp for (int m = 0; m < imgData->repeatX; m++) { for (int x = 0; x < imgData->bitmap->getWidth(); x++) { imgData->bitmap->getPixel(x, imgData->y, q); q += splashColorModeNComps[cMode]; } } drawImage() / scaleImage() allocate line buffers from the supplied width value: cpp lineBuf = (unsigned char )gmallocncheckoverflow(srcWidth, nComps); If surfacewidth repeatX overflows to a small positive value, the allocation becomes too small while tilingBitmapSrc still writes according to the larger repeat count, resulting in heap corruption. Relevant CWE IDs: CWE-190 (Integer Overflow or Wraparound)

CWE-122 / CWE-787 (Heap-based Buffer Overflow / Out-of-bounds Write)

Proposed Fix

Use checked arithmetic before dimension multiplication and avoid signed-overflow expressions in guards: diff diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc index XXXXXXX..YYYYYYY 100644 — a/poppler/SplashOutputDev.cc +++ b/poppler/SplashOutputDev.cc @@ -4342,7 +4342,13 @@ bool SplashOutputDev::tilingPatternFill(...) if (surfacewidth == 0 || surfaceheight == 0 || repeatX repeatY <= 4) { + int repeatArea = 0; + if (surfacewidth == 0 || surfaceheight == 0 || + checkedMultiply(repeatX, repeatY, &repeatArea) || + repeatArea <= 4) { state->setCTM(savedCTM[0], savedCTM[1], savedCTM[2], savedCTM[3], savedCTM[4], savedCTM[5]); return false; } @@ -4364,8 +4370,13 @@ bool SplashOutputDev::tilingPatternFill(...)

resultwidth = surfacewidth repeatX;

resultheight = surfaceheight repeatY; + if (checkedMultiply(surfacewidth, repeatX, &resultwidth) || + checkedMultiply(surfaceheight, repeatY, &resultheight) || + resultwidth <= 0 || resultheight <= 0) { + state->setCTM(savedCTM[0], savedCTM[1], savedCTM[2], savedCTM[3], savedCTM[4], savedCTM[5]); + return false; + } + kx = resultwidth / (fabs(kx) + 1); ky = resultheight / (fabs(ky) + 1);

------ This report was generated using AI technology. Always review AI-generated content prior to use

A use-after-free (write) vulnerability has been detected in Poppler within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a std::vector, which can lead to dangling pointers when the vector is resized.

A use-after-free (write) vulnerability has been detected in Poppler within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a std::vector, which can lead to dangling pointers when the vector is resized.

Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTSPDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::detail::Executor).

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for cairoftunscaledfontfini in cairo-ft-font.c.

Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Because std::atomicint is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

poppler uses std::atomicint for reference counting. Because it is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free.

Last updated 30 April 2025

A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INTMIN.

Last updated 8 April 2025

An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.

Reference: https://gitlab.freedesktop.org/poppler/poppler/issues/751

PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.

Reference: https://gitlab.freedesktop.org/poppler/poppler/issues/741

Upstream commit: https://gitlab.freedesktop.org/poppler/poppler/commit/fada09a2ccc11a3a1d308e810f1336d8df6011fd

Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsamplerowboxfilter function.

Reference: https://gitlab.freedesktop.org/poppler/poppler/issues/736

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.

Reference: https://gitlab.freedesktop.org/poppler/poppler/issues/728

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.

References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12797 https://gitlab.freedesktop.org/poppler/poppler/issues/717

Upstream Patch: https://gitlab.freedesktop.org/poppler/poppler/mergerequests/172

A flaw was found in Poppler 0.72.0. The PDFDoc::setup class in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/706

Upstream Patch: https://gitlab.freedesktop.org/poppler/poppler/commit/9fd5ec0e6e5f763b190f2a55ceb5427cfe851d5f

A flaw was found in Poppler 0.72.0. A NULL pointer dereference in the XRef::getEntry class in XRef.cc file due to the mishandle of unallocated XRef entries. This allows remote attackers to cause a denial of service via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/692

Upstream Patch: https://gitlab.freedesktop.org/poppler/poppler/mergerequests/143

A flaw was found in Poppler 0.72.0. A reachable Object::dictLookup assertion in FileSpec class in FileSpec.cc file allows attackers to cause a denial of service due to the lack of a check for the dict data type.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/704

Upstream Patch: https://gitlab.freedesktop.org/poppler/poppler/commit/de0c0b8324e776f0b851485e0fc9622fc35695b7

A flaw was found in Poppler 0.72.0. A reachable Object::getString assertion allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/703

Upstream Patch: https://gitlab.freedesktop.org/poppler/poppler/mergerequests/146

An issue was found in Poppler before 0.70.0. A NULL pointer dereference in popplerattachmentnew when called from popplerannotfileattachmentgetattachment.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/664

An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/660

An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/661

Upstream Patch: https://gitlab.freedesktop.org/poppler/poppler/mergerequests/109

An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/659

An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.

References: https://gitlab.freedesktop.org/poppler/poppler/issues/654

A flaw was found in Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.

References: https://bugzilla.redhat.com/showbug.cgi?id=1622951

Poppler is vulnerable to a NULL pointer dereference in the Annot.h:AnnotPath::getCoordsLength() function. An attacker could exploit this to cause a denial of service via crafted PDF.

Upstream Bug:

https://bugs.freedesktop.org/showbug.cgi?id=106408

Poppler has a stack-based buffer overflow in GfxState.cc, which allows attackers to cause a denial of service (application crash) via a crafted PDF document.

Upstream issue:

https://bugs.freedesktop.org/showbug.cgi?id=101540

Upstream patch:

https://cgit.freedesktop.org/poppler/poppler/commit/?id=8f4ff8243a3d599ff2a6c08b1da389e606ba4fc9

An insufficient escape sequences sanitization flaw was found in the way xpdf, a PDF file viewer for the X window system, and poppler, a PDF rendering library, performed sanitization of certain characters to be displayed in the error messages, which arose during presentation of certain PDF files. A remote attacker could use this flaw to modify a window's title, or, possibly execute arbitrary commands or overwrite files, via a specially-crafted PDF file containing an escape sequence for a terminal emulator if local, unsuspecting user opened such crafted PDF file in xpdf or in an application linked against poppler library (for example evince).