{"id":"CVE-2026-107705","summary":"Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()","details":"Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.","modified":"2026-10-10T02:47:25.752954824Z","published":"2026-10-08T19:51:12.884Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107705.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-121"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107705.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107705"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash"},{"type":"REPORT","url":"https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814"},{"type":"FIX","url":"https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398"},{"type":"PACKAGE","url":"https://gitlab.freedesktop.org/poppler/poppler"},{"type":"ARTICLE","url":"https://gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-26.10.0/poppler/Decrypt.cc#L1767"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.freedesktop.org/poppler/poppler","events":[{"introduced":"f8ff943650e7e2a4cb836be43bf04907a5e156fc"},{"fixed":"2703be11769c1f86f4d0dc3b276ec94bba5ac6d3"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0.42.0"},{"last_affected":"26.10.0"},{"fixed":"26.10.0"}]}}],"versions":["poppler-26.09.0","poppler-26.08.0","poppler-26.07.0","poppler-26.06.0","poppler-26.05.0","poppler-26.04.0","poppler-26.03.0","poppler-26.02.0","poppler-26.01.0","poppler-25.12.0","poppler-25.11.0","poppler-25.10.0","poppler-25.09.1","poppler-25.09.0","poppler-25.08.0","poppler-25.07.0","poppler-25.06.0","poppler-25.05.0","poppler-25.04.0","poppler-25.03.0","poppler-25.02.0","poppler-25.01.0","poppler-24.12.0","poppler-24.11.0","poppler-24.10.0","poppler-24.09.0","poppler-24.08.0","poppler-24.07.0","poppler-24.06.0","poppler-24.05.0","poppler-24.04.0","poppler-24.03.0","poppler-24.02.0","poppler-24.01.0","poppler-23.12.0","poppler-23.11.0","poppler-23.10.0","poppler-23.09.0","poppler-23.08.0","poppler-23.07.0","poppler-23.05.0","poppler-23.04.0","poppler-23.03.0","poppler-23.02.0","poppler-23.01.0","poppler-22.12.0","poppler-22.11.0","poppler-22.10.0","poppler-22.09.0","poppler-22.08.0","poppler-22.07.0","poppler-22.06.0","poppler-22.05.0","poppler-22.04.0","poppler-22.03.0","poppler-22.02.0","poppler-22.01.0","poppler-21.12.0","poppler-21.11.0","poppler-21.10.0","poppler-21.09.0","poppler-21.08.0","poppler-21.07.0","poppler-21.06.1","poppler-21.06.0","poppler-21.05.0","poppler-21.04.0","poppler-21.03.0","poppler-21.02.0","poppler-21.01.0","poppler-20.12.1","poppler-20.12.0","poppler-20.11.0","poppler-20.10.0","poppler-20.09.0","poppler-20.08.0","poppler-0.90.1","poppler-0.90.0","poppler-0.89.0","poppler-0.88.0","poppler-0.87.0","poppler-0.86.1","poppler-0.86.0","poppler-0.85.0","poppler-0.84.0","poppler-0.83.0","poppler-0.82.0","poppler-0.81.0","poppler-0.80.0","poppler-0.79.0","poppler-0.78.0","poppler-0.77.0","poppler-0.76.1","poppler-0.76.0","poppler-0.75.0","poppler-0.74.0","poppler-0.73.0","poppler-0.72.0","poppler-0.71.0","poppler-0.70.1","poppler-0.70.0","poppler-0.69.0","poppler-0.68.0","poppler-0.67.0","poppler-0.66.0","poppler-0.65.0","poppler-0.64.0","poppler-0.63.0","poppler-0.62.0","poppler-0.61.1","poppler-0.61","poppler-0.60.1","poppler-0.60","poppler-0.59","poppler-0.58","poppler-0.54","poppler-0.53","poppler-0.52","poppler-0.51","poppler-0.50","poppler-0.49","poppler-0.48","poppler-0.47","poppler-0.46","poppler-0.45","poppler-0.44","poppler-0.43","poppler-0.42.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107705.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}