Poppler CVE-2026-10118: Quick Look at the Integer Overflow in tilingPatternFill Leading to Heap Corruption

Introduction

Every Linux desktop environment that renders PDFs likely depends on Poppler, and a single malformed tiling pattern in a crafted PDF can now turn that dependency into a code execution vector. CVE-2026-10118 is an integer overflow in Poppler's Splash backend. When PDF rendering triggers it, Poppler makes an undersized heap allocation and then writes out of bounds, which can allow arbitrary code execution in the context of the application processing the file.

Poppler is the default PDF rendering library for GNOME's Evince and KDE's Okular, and it powers tools like GIMP, Inkscape, LibreOffice, and the widely deployed pdftoppm and pdftotext command-line utilities. It also runs well beyond desktop viewers, inside automated document processing pipelines on servers, so the attack surface is substantial.

Technical Information

Root Cause: Integer Overflow in Dimension Calculations

CVE-2026-10118 is classified under CWE-190 (Integer Overflow or Wraparound). Red Hat also maps it to CWE-122 (Heap-based Buffer Overflow) to capture the downstream consequence. The vulnerability has a CVSS v3 base score of 7.8.

The flaw is in the tilingPatternFill function in Poppler's Splash rendering backend. While processing a PDF tiling pattern, this function computes result_width and result_height values and then passes them to Splash::drawImage(). An attacker can craft a PDF file containing a /Pattern dictionary with specific /Matrix and /BBox values that make these dimension calculations overflow. The values then wrap around to a much smaller number than intended, so malloc allocates an undersized heap buffer. The rendering pipeline goes on to write image data into this buffer based on the original (pre-overflow) dimensions, which is a classic heap buffer overflow.

Aisle Research reported the vulnerability, and it is documented in the upstream GitLab issue tracker.

Affected Code Paths

AddressSanitizer output from the GitLab issue identifies the following affected functions and source locations:

The full call stack runs from main (in the pdftoppm utility) through PDFDoc::displayPageSlice, Page::displaySlice, Gfx::display, Gfx::go, Gfx::execOp, Gfx::opFill, Gfx::doPatternFill, Gfx::doTilingPatternFill, and SplashOutputDev::tilingPatternFill, into Splash::drawImage, and finally to the crash at SplashOutputDev::tilingBitmapSrc. So the overflow fires during normal PDF rendering, whenever the engine encounters a crafted tiling pattern.

AddressSanitizer reported a heap buffer overflow on a write of size 1, immediately after a 1,699,176-byte region allocated by malloc. That matches the pattern of an undersized allocation followed by an out-of-bounds write.

Attack Flow

The exploitation path is straightforward and requires no authentication or special privileges:

1. An attacker crafts a malicious PDF file containing a /Pattern object with manipulated /Matrix and /BBox values designed to trigger the integer overflow in the dimension calculations.
2. The attacker delivers this PDF to a victim via email, web download, or any other file transfer mechanism.
3. When the victim opens the PDF in any application using Poppler's Splash backend (Evince, Okular, pdftoppm, etc.), the rendering engine processes the tiling pattern.
4. The tilingPatternFill function computes result_width and result_height, which overflow because of the crafted values.
5. Poppler allocates an undersized heap buffer based on the overflowed (wrapped-around) dimensions.
6. The image rendering that follows writes data beyond the allocated buffer and corrupts heap memory.
7. Depending on heap layout and exploitation technique, this can lead to arbitrary code execution, information disclosure, or denial of service in the context of the application processing the PDF.

The attack vector is network/remote with low attack complexity. The upstream GitLab issue provides a reproduction command: pdftoppm -png ./reproducer-oob.pdf output -r 2500.

Affected Systems and Versions

All versions of Poppler prior to 26.05.0 (released May 3, 2026) that use the Splash rendering backend are affected. Poppler 26.05.0 includes the upstream fix.

Applications linked against vulnerable versions of Poppler's Splash backend include:

The poppler-utils package, bundled with most Linux distributions, provides command-line tools (pdfattach, pdfdetach, pdffonts, pdfimages, pdfinfo, pdfseparate, pdftocairo, pdftohtml, pdftoppm, pdftops, pdftotext, pdfunite) that are widely used in automated document processing pipelines.

As of June 1, 2026, distribution-level patches for CVE-2026-10118 have not yet been confirmed for RHEL, Debian, or Ubuntu. The earlier 2026 RHSAs for Poppler (RHSA-2026:0126, RHSA-2026:0774, RHSA-2026:0795, RHSA-2026:0773) address CVE-2025-32365, not this vulnerability.

Vendor Security History

Poppler has accumulated at least 27 CVEs according to CVEDetails, with a recurring pattern of memory corruption vulnerabilities triggered by crafted PDF input. The Splash backend has repeatedly been the source:

Heap-based buffer overflows and out-of-bounds access keep recurring, particularly in the Splash backend (CVE-2013-1789, CVE-2020-35702, CVE-2026-10118), which points to a persistent attack surface in how Poppler handles complex PDF structures. Neither the Splash nor the Cairo backend is inherently safer. CVE-2025-50422 shows that the Cairo path has its own vulnerability history. This pattern suggests that organizations should apply defense in depth to all PDF processing rather than relying solely on patching individual CVEs.

References

• NVD: CVE-2026-10118
• Red Hat CVE Page: CVE-2026-10118
• Red Hat Bugzilla: Bug 2460428
• Upstream GitLab Issue: Heap Buffer Overflow in tilingPatternFill via Integer Overflow (#1715)
• Poppler Releases
• Poppler GitLab Repository
• Poppler Freedesktop Wiki
• Debian Security Tracker: poppler
• CVEDetails: Poppler Vulnerabilities
• CVEDetails: CVE-2013-1789
• CVEDetails: CVE-2020-35702
• CVEDetails: CVE-2025-50422
• Proofpoint: 2026 Vulnerability Exploitation in the Wild
• RHSA-2026:0126
• RHSA-2026:0774
• Wikipedia: Poppler (software)