Poppler FoFiTrueType Signed Integer Overflow Leading to OOB Read

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Type: Signed Integer Overflow Location: ( ) Trigger Condition: When renders a PDF file containing a malformed TrueType font, (a 32-bit unsigned integer) is read from an attacker-controllable cmap table and assigned to a signed . When exceeds , the assignment wraps around, producing a negative value (e.g., ). Impact: Subsequent multiplication overflows, generating an incorrect offset, leading to an out-of-bounds read (OOB read). Affected Versions Affected Versions: Poppler 26.0.0 and earlier versions (prior to commit ) CVSS v3.1: 5.3 (Medium) Impacts: - Confidentiality: Low (OOB read may leak adjacent memory) - Integrity: Low (incorrect font layout may cause output corruption) - Availability: Low (behavior is undefined without sanitizers, potentially causing crashes or memory corruption) - Affects all applications or services using Poppler to render or convert untrusted PDF files Fix Details Fix Commit: (2026-07-26, "FoFiTrueType::mapCodeToGID: Improve b12 overflow check") First Version Containing Fix: Poppler 26.0.0 Fix Description: Before assigning to , validate whether exceeds the upper/lower bounds of a signed integer, or use an unsigned type ( ) to avoid signed integer wrap-around. POC / Exploit Code Build (UBSan): Run POC: UBSan Output (Key Error): ``` /home/ricky_1208/poppler_src/foFiTrueType.cc:608:41: runtime error: signed integer overflow: -134217248 #0 0x55d567632208 in FoFiTrueType::mapCodeToGID(int, unsigned int) const #1 0x55d5676347a0 in FoFiTrueType::mapCodeToGIDMap(FoFiTrueType*) #2 0x55d567600000 in SplashOutputDev::doPaintChar(...) #3 0x55d5676078f0 in SplashOutputDev::drawChar(...) #4 0x55d5676078f0 in Page::displaySlice(...) #5 0x55d5676078f0 in Page::displaySlice(...) #6 0x55d5676078f0 in Page::displaySlice(...) #7 0x55d5676078f0 in Page::displaySlice(...) #8 0x55d5676078f0 in Page::displaySlice(...) #9 0x55d5676078f0 in Page::displaySlice(...) #10 0x55d5676078f0 in Page::displaySlice(...) #11 0x55d5676078f0 in Page::displaySlice(...) #12 0x55d5676078f0 in Page::displaySlice(...) #13 0x55d5676078f0 in Page::displaySlice(...) #14 0x55d5676078f0 in Page::displaySlice(...) #15 0x55d5676078f0 in Page::displaySlice(...) #16 0x55d5676078f0 in Page::displaySlice(...) #17 0x55d5676078f0 in Page::displaySlice(...) #18 0x55d5676078f0 in Page::displaySlice(...) #19 0x55d5676078f0 in Page::displaySlice(...) #20 0x55d5676078f0 in Page::displaySlice(...) #21 0x55d5676078f0 in Page::displaySlice(...) #22 0x55d5676078f0 in Page::displaySlice(...) #23 0x55d5676078f0 in Page::displaySlice(...) #24 0x55d5676078f0 in Page::displaySlice(...) #25 0x55d5676078f0 in Page::displaySlice(...) #26 0x55d5676078f0 in Page::displaySlice(...) #27 0x55d5676078f0 in Page::displaySlice(...) #28 0x55d5676078f0 in Page::displaySlice(...) #29 0x55d5676078f0 in Page::displaySlice(...) #30 0x55d5676078f0 in Page::displaySlice(...) #31 0x55d5676078f0 in Page::displaySlice(...) #32 0x55d5676078f0 in Page::displaySlice(...) #33 0x55d5676078f0 in Page::displaySlice(...) #34 0x55d5676078f0 in Page::displaySlice(...) #35 0x55d5676078f0 in Page::displaySlice(...) #36 0x55d5676078f0 in Page::displaySlice(...) #37 0x55d5676078f0 in Page::displaySlice(...) #38 0x55d5676078f0 in Page::displaySlice(...) #39 0x55d5676078f0 in Page::displaySlice(...) #40 0x55d5676078f0 in Page::displaySlice(...) #41 0x55d5676078f0 in Page::displaySlice(...) #42 0x55d5676078f0 in Page::displaySlice(...) #43 0x55d5676078f0 in Page::displaySlice(...) #44 0x55d5676078f0 in Page::displaySlice(...) #45 0x55d5676078f0 in Page::displaySlice(...) #46 0x55d5676078f0 in Page::displaySlice(...) #47 0x55d5676078f0 in Page::displaySlice(...) #48 0x55d5676078f0 in Page::displaySlice(...) #49 0x55d5676078f0 in Page::displaySlice(...) #50 0x55d5676078f0 in Page::displaySlice(...) #51 0x55d5676078f0 in Page::displaySlice(...) #52 0x55d5676078f0 in Page::displaySlice(...) #53 0x55d5676078f0 in Page::displaySlice(...) #54 0x55d5676078f0 in Page::displaySlice(...) #55 0x55d5676078f0 in Page::displaySlice(...) #56 0x55d5676078f0 in Page::displaySlice(...) #57 0x55d5676078f0 in Page::displaySlice(...) #58 0x55d5676078f0 in Page::displaySlice(...) #59 0x55d5676078f0 in Page::displaySlice(...) #60 0x55d5676078f0 in Page::displaySlice(...) #61 0x55d5676078f0 in Page::displaySlice(...) #62 0x55d5676078f0 in Page::displaySlice(...) #63 0x55d5676078f0 in Page::displaySlice(...) #64 0x55d5676078f0 in Page::displaySlice(...) #65 0x55d5676078f0 in Page::displaySlice(...) #66 0x55d5676078f0 in Page::displaySlice(...) #67 0x55d5676078f0 in Page::displaySlice(...) #68 0x55d5676078f0 in Page::displaySlice(...) #69 0x55d5676078f0 in Page::displaySlice(...) #70 0x55d5676078f0 in Page::displaySlice(...) #71 0x55d5676078f0 in Page::displaySlice(...) #72 0x55d5676078f0 in Page::displaySlice(...) #73 0x55d5676078f0 in Page::displaySlice(...) #74 0x55d5676078f0 in Page::displaySlice(...) #75 0x55d5676078f0 in Page::displaySl

Goal Reached Thanks to every supporter — we hit 100%!

Poppler FoFiTrueType Signed Integer Overflow Leading to OOB Read

More from this source