Skip to content
Heist/ feed
HighFix available

DEBIAN-CVE-2026-10118

Type: advisorySource: OSV1 source record

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-10118

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-10118

poppler

Source reference: /affected/0/package/name

Affected versions
22.12.0-2

Source reference: /affected/0/versions

22.12.0-2+deb12u1

Source reference: /affected/0/versions

Fixed versions
22.12.0-2+deb12u2

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

poppler

Source reference: /affected/1/package/name

Affected versions
25.03.0-5

Source reference: /affected/1/versions

25.03.0-5+deb13u2

Source reference: /affected/1/versions

Fixed versions
25.03.0-5+deb13u3

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

poppler

Source reference: /affected/2/package/name

Affected versions
25.03.0-10

Source reference: /affected/2/versions

25.03.0-11

Source reference: /affected/2/versions

25.03.0-11.1

Source reference: /affected/2/versions

25.03.0-5

Source reference: /affected/2/versions

25.03.0-6

Source reference: /affected/2/versions

25.03.0-7

Source reference: /affected/2/versions

25.03.0-9

Source reference: /affected/2/versions

26.01.0-1

Source reference: /affected/2/versions

26.01.0-2

Source reference: /affected/2/versions

26.01.0-3

Source reference: /affected/2/versions

26.01.0-4

Source reference: /affected/2/versions

Fixed versions
26.01.0-4.1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "22.12.0-2+deb12u2"
          }
        ]
      }
    ],
    "package": {
      "name": "poppler",
      "purl": "pkg:deb/debian/poppler?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "22.12.0-2",
      "22.12.0-2+deb12u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10118.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "25.03.0-5+deb13u3"
          }
        ]
      }
    ],
    "package": {
      "name": "poppler",
      "purl": "pkg:deb/debian/poppler?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "25.03.0-5",
      "25.03.0-5+deb13u2"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10118.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "26.01.0-4.1"
          }
        ]
      }
    ],
    "package": {
      "name": "poppler",
      "purl": "pkg:deb/debian/poppler?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "25.03.0-10",
      "25.03.0-11",
      "25.03.0-11.1",
      "25.03.0-5",
      "25.03.0-6",
      "25.03.0-7",
      "25.03.0-9",
      "26.01.0-1",
      "26.01.0-2",
      "26.01.0-3",
      "26.01.0-4"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10118.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]
Related CVEs
CVE-2026-10118

Source reference: /upstream

Publisher severity

high

Source reference: /severity/0/score

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-10118 · High

Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat AI Inference Server 3.3, Red Hat AI Inference Server 3.3, Red Hat AI Inference Server 3.3, Red Hat AI Inference Server 3.3, Red Hat Hardened Images, Red Hat OpenShift AI 3.4, Red Hat Enterprise Linux 6

Event
#67693 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement