Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat poppler packages can let attackers cause crashes

published 17 days ago

Summary

The poppler, poppler-cpp, poppler-cpp-devel, poppler-devel, and poppler-glib packages from Red Hat contain a flaw that could be triggered by specially crafted files, potentially causing the program to stop working or run unintended code. This could affect any system that processes PDF documents using these packages. Update to the latest package versions as soon as possible to apply the fix.

What to do

Update redhat poppler to version 0:26.08.0-1.2.hum1.
Update redhat poppler-cpp to version 0:26.08.0-1.2.hum1.
Update redhat poppler-cpp-devel to version 0:26.08.0-1.2.hum1.
Update redhat poppler-devel to version 0:26.08.0-1.2.hum1.
Update redhat poppler-glib to version 0:26.08.0-1.2.hum1.
Update redhat poppler-glib-devel to version 0:26.08.0-1.2.hum1.
Update redhat poppler-glib-doc to version 0:26.08.0-1.2.hum1.
Update redhat poppler-qt6 to version 0:26.08.0-1.2.hum1.
Update redhat poppler-qt6-devel to version 0:26.08.0-1.2.hum1.
Update redhat poppler-utils to version 0:26.08.0-1.2.hum1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:hummingbird:1	redhat	poppler	< 0:26.08.0-1.2.hum1 Fix: upgrade to 0:26.08.0-1.2.hum1
Red Hat:hummingbird:1	redhat	poppler-cpp	< 0:26.08.0-1.2.hum1 Fix: upgrade to 0:26.08.0-1.2.hum1
Red Hat:hummingbird:1	redhat	poppler-cpp-devel	< 0:26.08.0-1.2.hum1 Fix: upgrade to 0:26.08.0-1.2.hum1
Red Hat:hummingbird:1	redhat	poppler-devel	< 0:26.08.0-1.2.hum1 Fix: upgrade to 0:26.08.0-1.2.hum1
Red Hat:hummingbird:1	redhat	poppler-glib	< 0:26.08.0-1.2.hum1 Fix: upgrade to 0:26.08.0-1.2.hum1
Red Hat:hummingbird:1	redhat	poppler-glib-devel	< 0:26.08.0-1.2.hum1 Fix: upgrade to 0:26.08.0-1.2.hum1
Red Hat:hummingbird:1	redhat	poppler-glib-doc	< 0:26.08.0-1.2.hum1 Fix: upgrade to 0:26.08.0-1.2.hum1
Red Hat:hummingbird:1	redhat	poppler-qt6	< 0:26.08.0-1.2.hum1 Fix: upgrade to 0:26.08.0-1.2.hum1
Red Hat:hummingbird:1	redhat	poppler-qt6-devel	< 0:26.08.0-1.2.hum1 Fix: upgrade to 0:26.08.0-1.2.hum1
Red Hat:hummingbird:1	redhat	poppler-utils	< 0:26.08.0-1.2.hum1 Fix: upgrade to 0:26.08.0-1.2.hum1

Original advisory text

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

References

https://access.redhat.com/errata/RHSA-2026:74469 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-102620 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-102621 Third Party Advisory
https://access.redhat.com/security/updates/classification/ Third Party Advisory
https://images.redhat.com/ Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74469.... Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2543645 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-102620 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-102620 Vendor Advisory
https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFi... Third Party Advisory
https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fd... Third Party Advisory
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2326 Third Party Advisory
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1762 Third Party Advisory
https://vuldb.com/cve/CVE-2026-102620 Third Party Advisory
https://vuldb.com/submit/942348 Third Party Advisory
https://vuldb.com/vuln/411410 Third Party Advisory
https://vuldb.com/vuln/411410/cti Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2543683 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-102621 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-102621 Vendor Advisory
https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-Spla... Third Party Advisory
https://gitlab.freedesktop.org/poppler/poppler/-/commit/323c91036d99926a8b90dc14... Third Party Advisory
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2325 Third Party Advisory
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1763 Third Party Advisory
https://vuldb.com/cve/CVE-2026-102621 Third Party Advisory
https://vuldb.com/submit/942349 Third Party Advisory
https://vuldb.com/vuln/411411 Third Party Advisory
https://vuldb.com/vuln/411411/cti Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

3.3 Low

Timeline

Published2 Oct 2026

Updated2 Oct 2026

First seen2 Oct 2026

Sources

RHSA-2026:74469 · OSV

Track software like this

Free during beta