p PatchFirst

CVE-2026-93313

CVE-2026-93313 · Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • poppler

    Versions
    • 26.07.0: Affected

    No fix published

  • poppler Debian:12

    Versions
    • 22.12.0-2
    • 22.12.0-2+deb12u1
    • 22.12.0-2+deb12u2
    • 22.12.0-2+deb12u3
    • 22.12.0-2.1
    • 22.12.0-2.2
    • 23.08.0-1
    • 23.08.0-2
    • 23.12.0-1
    • 24.02.0-1
    • 24.02.0-2
    • 24.02.0-3
    • 24.02.0-4
    • 24.02.0-5
    • 24.02.0-5+loong64
    • 24.06.0-1
    • 24.06.0-2
    • 24.08.0-1
    • 24.08.0-2
    • 24.08.0-3
    • 24.08.0-4
    • 25.01.0-1
    • 25.01.0-2
    • 25.01.0-3
    • 25.01.0-4
    • 25.01.0-5
    • 25.03.0-1
    • 25.03.0-10
    • 25.03.0-11
    • 25.03.0-11.1
    • 25.03.0-2
    • 25.03.0-3
    • 25.03.0-4
    • 25.03.0-5
    • 25.03.0-6
    • 25.03.0-7
    • 25.03.0-9
    • 26.01.0-1
    • 26.01.0-2
    • 26.01.0-3
    • 26.01.0-4
    • 26.01.0-4.1
    • 26.01.0-5
    • 26.07.0-1
    • 26.07.0-2
    • 26.07.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poppler Debian:13

    Versions
    • 25.03.0-10
    • 25.03.0-11
    • 25.03.0-11.1
    • 25.03.0-5
    • 25.03.0-5+deb13u2
    • 25.03.0-5+deb13u3
    • 25.03.0-5+deb13u4
    • 25.03.0-6
    • 25.03.0-7
    • 25.03.0-9
    • 26.01.0-1
    • 26.01.0-2
    • 26.01.0-3
    • 26.01.0-4
    • 26.01.0-4.1
    • 26.01.0-5
    • 26.07.0-1
    • 26.07.0-2
    • 26.07.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poppler Debian:14

    Versions
    • 25.03.0-10
    • 25.03.0-11
    • 25.03.0-11.1
    • 25.03.0-5
    • 25.03.0-6
    • 25.03.0-7
    • 25.03.0-9
    • 26.01.0-1
    • 26.01.0-2
    • 26.01.0-3
    • 26.01.0-4
    • 26.01.0-4.1
    • 26.01.0-5
    • 26.07.0-1
    • 26.07.0-2
    Affected ranges
    • ECOSYSTEM: < 26.07.0-3

    Update to 26.07.0-3

  • poppler Ubuntu:Pro:16.04:LTS

    Versions
    • 0.33.0-0ubuntu3
    • 0.37.0-0ubuntu1
    • 0.38.0-0ubuntu1
    • 0.41.0-0ubuntu1
    • 0.41.0-0ubuntu1.1
    • 0.41.0-0ubuntu1.2
    • 0.41.0-0ubuntu1.3
    • 0.41.0-0ubuntu1.4
    • 0.41.0-0ubuntu1.5
    • 0.41.0-0ubuntu1.6
    • 0.41.0-0ubuntu1.7
    • 0.41.0-0ubuntu1.8
    • 0.41.0-0ubuntu1.9
    • 0.41.0-0ubuntu1.10
    • 0.41.0-0ubuntu1.11
    • 0.41.0-0ubuntu1.12
    • 0.41.0-0ubuntu1.13
    • 0.41.0-0ubuntu1.14
    • 0.41.0-0ubuntu1.15
    • 0.41.0-0ubuntu1.16
    • 0.41.0-0ubuntu1.16+esm1
    • 0.41.0-0ubuntu1.16+esm2
    • 0.41.0-0ubuntu1.16+esm3
    • 0.41.0-0ubuntu1.16+esm4
    • 0.41.0-0ubuntu1.16+esm5
    • 0.41.0-0ubuntu1.16+esm6
    • 0.41.0-0ubuntu1.16+esm7
    • 0.41.0-0ubuntu1.16+esm8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poppler Ubuntu:Pro:18.04:LTS

    Versions
    • 0.57.0-2ubuntu4
    • 0.57.0-2ubuntu5
    • 0.62.0-1ubuntu1
    • 0.62.0-2ubuntu1
    • 0.62.0-2ubuntu2
    • 0.62.0-2ubuntu2.1
    • 0.62.0-2ubuntu2.2
    • 0.62.0-2ubuntu2.4
    • 0.62.0-2ubuntu2.5
    • 0.62.0-2ubuntu2.6
    • 0.62.0-2ubuntu2.7
    • 0.62.0-2ubuntu2.8
    • 0.62.0-2ubuntu2.9
    • 0.62.0-2ubuntu2.10
    • 0.62.0-2ubuntu2.11
    • 0.62.0-2ubuntu2.12
    • 0.62.0-2ubuntu2.13
    • 0.62.0-2ubuntu2.14
    • 0.62.0-2ubuntu2.14+esm1
    • 0.62.0-2ubuntu2.14+esm2
    • 0.62.0-2ubuntu2.14+esm3
    • 0.62.0-2ubuntu2.14+esm4
    • 0.62.0-2ubuntu2.14+esm5
    • 0.62.0-2ubuntu2.14+esm6
    • 0.62.0-2ubuntu2.14+esm7
    • 0.62.0-2ubuntu2.14+esm8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poppler Ubuntu:Pro:20.04:LTS

    Versions
    • 0.80.0-0ubuntu1
    • 0.80.0-0ubuntu3
    • 0.80.0-0ubuntu4
    • 0.80.0-0ubuntu5
    • 0.85.0-1ubuntu1
    • 0.85.0-1ubuntu3
    • 0.86.1-0ubuntu1
    • 0.86.1-0ubuntu1.1
    • 0.86.1-0ubuntu1.2
    • 0.86.1-0ubuntu1.3
    • 0.86.1-0ubuntu1.4
    • 0.86.1-0ubuntu1.5
    • 0.86.1-0ubuntu1.6
    • 0.86.1-0ubuntu1.7
    • 0.86.1-0ubuntu1.7+esm1
    • 0.86.1-0ubuntu1.7+esm2
    • 0.86.1-0ubuntu1.7+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poppler Ubuntu:22.04:LTS

    Versions
    • 21.06.1-1
    • 21.11.0-1~ubuntu2
    • 22.02.0-2
    • 22.02.0-2ubuntu0.1
    • 22.02.0-2ubuntu0.2
    • 22.02.0-2ubuntu0.3
    • 22.02.0-2ubuntu0.4
    • 22.02.0-2ubuntu0.5
    • 22.02.0-2ubuntu0.6
    • 22.02.0-2ubuntu0.7
    • 22.02.0-2ubuntu0.8
    • 22.02.0-2ubuntu0.9
    • 22.02.0-2ubuntu0.10
    • 22.02.0-2ubuntu0.11
    • 22.02.0-2ubuntu0.12
    • 22.02.0-2ubuntu0.13
    Affected ranges
    • ECOSYSTEM: < 22.02.0-2ubuntu0.14

    Update to 22.02.0-2ubuntu0.14

  • poppler Ubuntu:24.04:LTS

    Versions
    • 23.08.0-2ubuntu1
    • 23.12.0-1ubuntu2
    • 24.02.0-1ubuntu2
    • 24.02.0-1ubuntu8
    • 24.02.0-1ubuntu9
    • 24.02.0-1ubuntu9.1
    • 24.02.0-1ubuntu9.2
    • 24.02.0-1ubuntu9.3
    • 24.02.0-1ubuntu9.4
    • 24.02.0-1ubuntu9.5
    • 24.02.0-1ubuntu9.6
    • 24.02.0-1ubuntu9.7
    • 24.02.0-1ubuntu9.8
    • 24.02.0-1ubuntu9.9
    Affected ranges
    • ECOSYSTEM: < 24.02.0-1ubuntu9.10

    Update to 24.02.0-1ubuntu9.10

  • poppler Ubuntu:26.04:LTS

    Versions
    • 25.03.0-10
    • 25.03.0-11.1
    • 26.01.0-2build2
    • 26.01.0-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 26.01.0-2ubuntu0.2

    Update to 26.01.0-2ubuntu0.2

Original sources

Check your server →