freedesktop CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH freedesktop CVE published 2026-10-08

CVE-2026-107705

A stack-based buffer overflow vulnerability exists in Poppler 0.42.0 through 26.10.0 in the Decrypt::revision6Hash() function. This allows attackers to overwrite stack memory by providing a password longer than 127 bytes when opening AESV3/R6 encrypted PDFs, potentially crashing the process or corrupting memory. The vulnerability can be triggered through applications using libpoppler, libpoppler-glib, or [truncated]

HIGH Freedesktop CVE published 2026-06-04

CVE-2026-50292

CVE-2026-50292 is a HIGH severity vulnerability in libinput, a library used for handling input devices. The vulnerability exists in versions before 1.30.4 and 1.31.x before 1.31.3. An unescaped phys output in libinput-device-group can inject udev properties, potentially leading to arbitrary root code execution.