CVE-2026-107705

Publication date 8 October 2026

Last updated 21 October 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.5 · Medium

Score breakdown

Description

Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.

Read the notes from the security team

Status

Package Ubuntu Release Status
poppler 26.10 stonking
Fixed in 26.07.0-2ubuntu1.1
26.04 LTS resolute
Fixed in 26.01.0-2ubuntu0.3
24.04 LTS noble
Fixed in 24.02.0-1ubuntu9.11
22.04 LTS jammy
Fixed in 22.02.0-2ubuntu0.15
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation

Notes

mdeslaur

compiler hardening in Ubuntu likely reduces this issue to a denial of service only. In addition, this only affects use of the poppler API, poppler's own tools enforce their own password length restriction.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
poppler

Severity score breakdown

CVSS version:

Base score 8.3 · High

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Base score 6.5 · Medium

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-8950-1
    • poppler vulnerability
    • 21 October 2026

Other references

Access our resources on patching vulnerabilities