freedesktop vulnerabilities

Products

• poppler 95
• dbus 24
• udisks 5
• xdg-utils 5
• libinput 4
• accountsservice 3
• gst-plugins-good 3
• dbus-glib 2
• libbsd 2
• policykit 2
• polkit 2
• colord 1
• dbus1.0 1
• dbus1.1.0 1
• freetype demo programs 1
• gst-plugins-bad 1
• libdbus 1
• libice 1
• scratchbox2 1
• spice-gtk 1
• telepathy gabble 1
• virglrenderer 1
• xdg-user-dirs 1

Latest freedesktop CVEs

Newest publication first · page 1 of 7

1. CVE-2026-107705 Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()

   Published 2026-10-08

   High·CVSS 8.3 EPSS 0.32%

   Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applicati...

2. CVE-2026-102621 Freedesktop Poppler SplashClip.cc clipToPath integer overflow

   Published 2026-09-29

   Medium·CVSS 4.8 EPSS 0.11%

   A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly a...

3. CVE-2026-102620 Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow

   Published 2026-09-29

   Medium·CVSS 4.8 EPSS 0.11%

   A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disc...

4. CVE-2026-93314 Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow

   Published 2026-09-18

   Medium·CVSS 5.3 EPSS 0.24%

   A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has...

5. CVE-2026-93313 Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow

   Published 2026-09-18

   Medium·CVSS 5.3 EPSS 0.24%

   A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made...

6. CVE-2026-93312 Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference

   Published 2026-09-18

   Medium·CVSS 5.3 EPSS 0.40%

   A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used...

7. CVE-2026-93311 Freedesktop Poppler SampledFunction Function.cc integer overflow

   Published 2026-09-18

   Medium·CVSS 5.3 EPSS 0.56%

   A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack m...

8. CVE-2026-50292 In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

   Published 2026-06-04

   Critical·CVSS 9.8 EPSS 0.31%

   In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

9. CVE-2026-46470 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before perf...

   Published 2026-05-14

   Critical·CVSS 9.1 EPSS 0.21%

   An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division...

10. CVE-2026-46469 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_parse_trak function does not sufficiently validate atom data before perf...

    Published 2026-05-14

    Medium·CVSS 5.5 EPSS 0.10%

    An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_parse_trak function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division...

11. CVE-2026-35093 Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins

    Published 2026-04-01

    High·CVSS 8.8 EPSS 0.18%

    A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program usin...

12. CVE-2026-35094 Libinput: libinput: information disclosure via dangling pointer in lua plugin handling

    Published 2026-04-01

    Medium·CVSS 5.5 EPSS 0.15%

    A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system log...

13. CVE-2026-4897 Polkit: polkit: denial of service via unbounded input processing through standard input

    Published 2026-03-26

    Medium·CVSS 5.5 EPSS 0.16%

    A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the polkit-agent-helper-1 setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Se...

14. CVE-2026-1940 Gstreamer: incomplete fix of cve-2026-1940

    Published 2026-03-23

    High·CVSS 7.5 EPSS 0.24%

    An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd num...

15. CVE-2026-26104 Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api

    Published 2026-02-25

    Medium·CVSS 5.5 EPSS 0.08%

    A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a...

16. CVE-2026-26103 Udisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api

    Published 2026-02-25

    High·CVSS 7.1 EPSS 0.08%

    A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption meta...

17. CVE-2025-43718 Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular express...

    Published 2025-10-01

    Low·CVSS 2.9 EPSS 0.13%

    Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetada...

18. CVE-2025-50420 An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS).

    Published 2025-08-04

    Medium·CVSS 6.5 EPSS 0.37%

    An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS).

19. CVE-2025-52886 Poppler Use After Free Vulnerability

    Published 2025-07-02

    Medium·CVSS 5.5 EPSS 0.45%

    Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomic_int for reference counting. Because std::atomic_int is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

20. CVE-2025-43903 NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.

    Published 2025-04-18

    Low·CVSS 3.3 EPSS 0.11%

    NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.

21. CVE-2025-32365 Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.

    Published 2025-04-05

    High·CVSS 7.1 EPSS 0.26%

    Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.

22. CVE-2025-32364 A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.

    Published 2025-04-05

    Medium·CVSS 5.5 EPSS 0.27%

    A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.

23. CVE-2024-56378 libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.

    Published 2024-12-22

    Medium·CVSS 4.3 EPSS 0.62%

    libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.

24. CVE-2024-6239 Poppler: pdfinfo: crash in broken documents when using -dests parameter

    Published 2024-06-21

    High·CVSS 7.5 EPSS 0.78%

    A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.

25. CVE-2022-38349 An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving a...

    Published 2023-08-22

    Medium·CVSS 6.5 EPSS 1.1%

    An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.