Description
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
freedesktop poppler
Default version status: unaffected
0.42.0 to ≤ 26.10.0affected
References
- https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814 ↗
- https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398 ↗
- https://gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-26.10.0/poppler/Decrypt.cc#L1767 ↗
- https://gitlab.freedesktop.org/poppler/poppler ↗
- https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash ↗