Stack-based Buffer Overflow in Poppler Affects Multiple Versions

CVE-2026-107705

What is CVE-2026-107705?

Poppler versions 0.42.0 through 26.10.0 are affected by a stack-based buffer overflow vulnerability in the Decrypt::revision6Hash() function. This issue arises when attackers provide excessively long passwords (over 127 bytes) while opening AESV3/R6 encrypted PDFs. The vulnerability allows attackers to manipulate stack memory, potentially leading to process crashes or memory corruption. Applications utilizing the libpoppler, libpoppler-glib, or C++ API are particularly susceptible to this exploit. The risk emphasizes the importance of ensuring that user-provided passwords do not exceed the expected length to mitigate the threat.

References