PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10118 Red Hat CVE debrief

A high-severity integer overflow vulnerability in Poppler's Splash backend allows remote attackers to achieve arbitrary code execution, information disclosure, or denial of service through maliciously crafted PDF files. The flaw resides in the `tilingPatternFill` function, where an integer overflow during rendering leads to an undersized heap allocation and subsequent out-of-bounds write. The vulnerability requires user interaction (opening a malicious PDF) and results in local attack vector execution with high impact to confidentiality, integrity, and availability. The vendor attribution to Poppler is derived from reference domain analysis with low confidence and requires review; the product name is not specified in available sources. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA KEV.

Vendor
Red Hat
Product
Red Hat Enterprise Linux 10
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-21
Advisory published
2026-06-01
Advisory updated
2026-07-21

Who should care

Organizations using applications that render PDFs via Poppler's Splash backend, including document viewers, print servers, and automated PDF processing pipelines. Linux distributions and enterprises relying on Poppler-derived tools (Evince, Okular, pdftotext, etc.) should prioritize patching. Security teams in environments where untrusted PDF ingestion occurs should implement containment measures.

Technical summary

The vulnerability exists in Poppler's Splash rendering backend, specifically in the `tilingPatternFill` function. When processing a crafted PDF with tiling pattern fill operations, an integer overflow occurs during memory size calculations. This overflow causes an undersized heap memory allocation, and subsequent write operations exceed the allocated buffer boundary. The out-of-bounds write can corrupt heap metadata or adjacent structures, potentially leading to arbitrary code execution within the context of the PDF processing application. The attack requires social engineering or user action to open a malicious PDF document.

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor-supplied patches for Poppler when available from distribution maintainers or upstream
  • Configure PDF processing applications to use non-Splash backends (e.g., Cairo backend) where supported and feasible
  • Implement sandboxing or isolation for PDF rendering processes to contain potential exploitation
  • Restrict processing of untrusted PDF files in security-critical environments pending patch availability
  • Monitor Poppler upstream and distribution security advisories for patch release notifications

Evidence notes

CVE description identifies Poppler Splash backend `tilingPatternFill` integer overflow leading to heap-based out-of-bounds write. CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms local attack vector with user interaction required. CWE-190 (Integer Overflow or Wraparound) assigned by Red Hat. Vendor field shows 'Unknown Vendor' with low-confidence 'Redhat' domain candidate requiring review. No CPE criteria available. VulnStatus: Awaiting Analysis.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10118 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10118

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10118 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10118

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.