Source: poppler Version: 26.07.0-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forwarded: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814
Hi, The following vulnerability was published for poppler. CVE-2026-107705[0]: | Poppler 0.42.0 through 26.10.0 contains a stack-based buffer | overflow in Decrypt::revision6Hash() that allows attackers | controlling the password to overwrite stack memory when opening | AESV3/R6 encrypted PDFs. Attackers can supply a password longer than | 127 bytes through applications using the libpoppler, libpoppler-glib | or C++ API to overflow the K1 and E buffers, crashing the process or | corrupting memory. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-107705 https://www.cve.org/CVERecord?id=CVE-2026-107705 [1] https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814 [2] https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
