Poppler: Stack-based buffer overflow in revision6Hash() via long password

Summary

Poppler versions 0.42.0 through 26.10.0 contain a stack-based buffer overflow in Decrypt::revision6Hash(), which is triggered when opening AESV3/R6-encrypted PDF files. An attacker who controls the password supplied to an application that uses libpoppler, libpoppler-glib or the C++ API can supply a password longer than 127 bytes and overwrite stack memory. This can crash the process or corrupt memory. The CVSS 4.0 vector does not state code execution, and exploitation requires an application that accepts a password the attacker can influence.

Affected

• freedesktop.org Poppler 0.42.0 through 26.10.0 (per the CVE record; default build assumed affected)
• Applications and distribution packages that embed libpoppler, libpoppler-glib or the C++ API

Fixed in

• Upstream fixed version: Unknown.
• Ubuntu has published fixes: 26.01.0-2ubuntu0.3 (resolute), 26.07.0-2ubuntu1.1 (stonking) and 24.02.0-1ubuntu9.11 (noble).
• Other distributions may ship patches; check your vendor's security advisories.

Workaround

• No official workaround is published.
• Until patched packages are installed, limit which applications can open untrusted encrypted PDFs.
• Do not let untrusted input supply passwords to automated PDF processing (this is our own reasoning, not a vendor recommendation).

Exploitation

• No evidence of exploitation in the wild was found.
• No public proof-of-concept was identified.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
• EPSS is about 0.003 (low).

Our recommendation

• Update Poppler-based packages through your Linux distribution, prioritizing systems that process PDFs from untrusted sources.
• Prioritize server-side, automated or document-processing pipelines, conversion and indexing services, and thumbnail or scanning services that accept passwords from users or external systems.
• Check which systems use Poppler (for example poppler-utils or libpoppler-based tools) and monitor vendor advisories until the upstream fix is confirmed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-107705 Ubuntu security ubuntu.com
• VulnCheck advisory www.vulncheck.com
• Poppler merge request 2398 gitlab.freedesktop.org
• Poppler tracking issue 1814 gitlab.freedesktop.org
• Poppler Decrypt.cc (26.10.0) gitlab.freedesktop.org
• Poppler releases poppler.freedesktop.org
• Ubuntu poppler resolute update www.ubuntuupdates.org
• SUSE CVE entry vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:58.