CVE-2026-10118: Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

Synopsis

An integer overflow vulnerability in Poppler's Splash rendering backend (the SplashOutputDev::tilingPatternFill function) allows a crafted PDF file to trigger an undersized heap allocation followed by an out-of-bounds write. The attack is local in vector but requires the victim to open a malicious PDF, and no authentication is needed beyond convincing the user to render the file. Successful exploitation gives the attacker arbitrary code execution, the ability to read sensitive in-process data, or the ability to crash the application processing the PDF. No upstream fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The CVSS vector is AV:L, meaning the attacker does not need network access; an existing shell or process on the host, or delivery of a malicious file to a local user, is sufficient.

• AuthenticationNot required

  PR:N indicates no account or credential on the target system is required to stage the attack.

• Victim interactionRequired

  UI:R means a human user must take an action, specifically opening or rendering the crafted PDF file, for the exploit to trigger.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free once the victim opens the file, with no race conditions or special memory layout requirements needed.

Blast Radius

• Executes arbitrary code in the context of the application processing the PDF, giving the attacker full control over that process.
• Reads in-process memory contents, which may include session tokens, credentials, or document data loaded by the application.
• Writes to out-of-bounds heap memory, corrupting adjacent allocations and potentially pivoting to broader process compromise.
• Crashes the PDF-processing application entirely, causing a denial of service for any workflow depending on that rendering path.