poppler: A flaw was found in Poppler's Splash backend
CVE-2026-10118 is fixed in 36 products on 1 platform, first by gir1.2-poppler-0.18 26.01.0-2ubuntu0.1, released June 1, 2026. It is not reported as exploited. Patch Radar priority: High.
A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| compat-poppler22 · amzn 2023 | 22.08.0-3.amzn2023.0.6 | ALAS2023-2026-1851 | Jun 22, 2026 |
| compat-poppler22-cpp · amzn 2023 | 22.08.0-3.amzn2023.0.6 | ALAS2023-2026-1851 | Jun 22, 2026 |
| compat-poppler22-cpp-debuginfo · amzn 2023 | 22.08.0-3.amzn2023.0.6 | ALAS2023-2026-1851 | Jun 22, 2026 |
| compat-poppler22-debuginfo · amzn 2023 | 22.08.0-3.amzn2023.0.6 | ALAS2023-2026-1851 | Jun 22, 2026 |
| compat-poppler22-debugsource · amzn 2023 | 22.08.0-3.amzn2023.0.6 | ALAS2023-2026-1851 | Jun 22, 2026 |
| gir1.2-poppler-0.18 · Ubuntu 22.04.1 LTS (jammy) | 22.02.0-2ubuntu0.13 | gir1.2-poppler-0.18 22.02.0-2ubuntu0.13 | Jun 24, 2026 |
| gir1.2-poppler-0.18 · Ubuntu 24.04.5 LTS (noble) | 24.02.0-1ubuntu9.9 | gir1.2-poppler-0.18 24.02.0-1ubuntu9.9 | Jun 24, 2026 |
| gir1.2-poppler-0.18 · Ubuntu 25.10 (questing) | 25.03.0-10ubuntu0.2 | gir1.2-poppler-0.18 25.03.0-10ubuntu0.2 | Jun 24, 2026 |
| gir1.2-poppler-0.18 · Ubuntu 26.04.1 LTS (resolute) | 26.01.0-2ubuntu0.1 | gir1.2-poppler-0.18 26.01.0-2ubuntu0.1 | Jun 1, 2026 |
| libpoppler-cpp0t64 · Ubuntu 24.04.5 LTS (noble) | 24.02.0-1ubuntu9.9 | libpoppler-cpp0t64 24.02.0-1ubuntu9.9 | Jun 24, 2026 |
| libpoppler-cpp0v5 · Ubuntu 22.04.1 LTS (jammy) | 22.02.0-2ubuntu0.13 | libpoppler-cpp0v5 22.02.0-2ubuntu0.13 | Jun 24, 2026 |
| libpoppler-cpp2 · Ubuntu 25.10 (questing) | 25.03.0-10ubuntu0.2 | libpoppler-cpp2 25.03.0-10ubuntu0.2 | Jun 24, 2026 |
| libpoppler-cpp3 · Ubuntu 26.04.1 LTS (resolute) | 26.01.0-2ubuntu0.1 | libpoppler-cpp3 26.01.0-2ubuntu0.1 | Jun 1, 2026 |
| libpoppler-glib8 · Ubuntu 22.04.1 LTS (jammy) | 22.02.0-2ubuntu0.13 | libpoppler-glib8 22.02.0-2ubuntu0.13 | Jun 24, 2026 |
| libpoppler-glib8t64 · Ubuntu 24.04.5 LTS (noble) | 24.02.0-1ubuntu9.9 | libpoppler-glib8t64 24.02.0-1ubuntu9.9 | Jun 24, 2026 |
| libpoppler-glib8t64 · Ubuntu 25.10 (questing) | 25.03.0-10ubuntu0.2 | libpoppler-glib8t64 25.03.0-10ubuntu0.2 | Jun 24, 2026 |
| libpoppler-glib8t64 · Ubuntu 26.04.1 LTS (resolute) | 26.01.0-2ubuntu0.1 | libpoppler-glib8t64 26.01.0-2ubuntu0.1 | Jun 1, 2026 |
| libpoppler-qt5-1 · Ubuntu 22.04.1 LTS (jammy) | 22.02.0-2ubuntu0.13 | libpoppler-qt5-1 22.02.0-2ubuntu0.13 | Jun 24, 2026 |
| libpoppler-qt5-1t64 · Ubuntu 24.04.5 LTS (noble) | 24.02.0-1ubuntu9.9 | libpoppler-qt5-1t64 24.02.0-1ubuntu9.9 | Jun 24, 2026 |
| libpoppler-qt5-1t64 · Ubuntu 25.10 (questing) | 25.03.0-10ubuntu0.2 | libpoppler-qt5-1t64 25.03.0-10ubuntu0.2 | Jun 24, 2026 |
| libpoppler-qt5-1t64 · Ubuntu 26.04.1 LTS (resolute) | 26.01.0-2ubuntu0.1 | libpoppler-qt5-1t64 26.01.0-2ubuntu0.1 | Jun 1, 2026 |
| libpoppler-qt6-3t64 · Ubuntu 24.04.5 LTS (noble) | 24.02.0-1ubuntu9.9 | libpoppler-qt6-3t64 24.02.0-1ubuntu9.9 | Jun 24, 2026 |
| libpoppler-qt6-3t64 · Ubuntu 25.10 (questing) | 25.03.0-10ubuntu0.2 | libpoppler-qt6-3t64 25.03.0-10ubuntu0.2 | Jun 24, 2026 |
| libpoppler-qt6-3t64 · Ubuntu 26.04.1 LTS (resolute) | 26.01.0-2ubuntu0.1 | libpoppler-qt6-3t64 26.01.0-2ubuntu0.1 | Jun 1, 2026 |
| libpoppler118 · Ubuntu 22.04.1 LTS (jammy) | 22.02.0-2ubuntu0.13 | libpoppler118 22.02.0-2ubuntu0.13 | Jun 24, 2026 |
| libpoppler134 · Ubuntu 24.04.5 LTS (noble) | 24.02.0-1ubuntu9.9 | libpoppler134 24.02.0-1ubuntu9.9 | Jun 24, 2026 |
| libpoppler147 · Ubuntu 25.10 (questing) | 25.03.0-10ubuntu0.2 | libpoppler147 25.03.0-10ubuntu0.2 | Jun 24, 2026 |
| libpoppler156 · Ubuntu 26.04.1 LTS (resolute) | 26.01.0-2ubuntu0.1 | libpoppler156 26.01.0-2ubuntu0.1 | Jun 1, 2026 |
| poppler · Debian 12.15 (bookworm) | 22.12.0-2+deb12u2 | DEBIAN-CVE-2026-10118 | Jun 24, 2026 |
| poppler · Debian 13.5 (trixie) | 25.03.0-5+deb13u3 | DEBIAN-CVE-2026-10118 | Jun 24, 2026 |
| poppler · Debian 14 | 26.01.0-4.1 | DEBIAN-CVE-2026-10118 | Jun 24, 2026 |
| poppler · RHEL 10 | 24.02.0-7.el10_0.1 | RHSA-2026:27720 | Jun 24, 2026 |
| poppler · RHEL 8 | 0:20.11.0-14.el8_10 | RHSA-2026:24984 | Jun 24, 2026 |
| poppler · RHEL 9 | 0:21.01.0-24.el9_8.1 | RHSA-2026:25058 | Jun 24, 2026 |
| poppler · almalinux 10 | 24.02.0-7.el10_2.2 | ALSA-2026:24985 | Jun 10, 2026 |
| poppler · almalinux 8 | 20.11.0-14.el8_10 | ALSA-2026:24984 | Jun 10, 2026 |
| poppler · almalinux 9 | 21.01.0-24.el9_8.1 | ALSA-2026:25058 | Jun 10, 2026 |
| poppler · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler · ol 10 | 0:24.02.0-7.el10_2.2 | ELSA-2026-24985 | Jul 16, 2026 |
| poppler · ol 8 | 0:20.11.0-14.el8_10 | ELSA-2026-24984 | Jun 10, 2026 |
| poppler · ol 9 | 0:21.01.0-24.el9_8.1 | ELSA-2026-25058 | Jun 23, 2026 |
| poppler · rocky 10 | 0:24.02.0-7.el10_2.2 | RLSA-2026:24985 | Jun 13, 2026 |
| poppler · rocky 8 | 0:20.11.0-14.el8_10 | RLSA-2026:24984 | Jun 12, 2026 |
| poppler · rocky 9 | 0:21.01.0-24.el9_8.1 | RLSA-2026:25058 | Jun 13, 2026 |
| poppler-cpp · RHEL 8 | 0:20.11.0-14.el8_10 | RHSA-2026:24984 | Jun 24, 2026 |
| poppler-cpp · RHEL 9 | 0:21.01.0-24.el9_8.1 | RHSA-2026:25058 | Jun 24, 2026 |
| poppler-cpp · almalinux 10 | 24.02.0-7.el10_2.2 | ALSA-2026:24985 | Jun 10, 2026 |
| poppler-cpp · almalinux 8 | 20.11.0-14.el8_10 | ALSA-2026:24984 | Jun 10, 2026 |
| poppler-cpp · almalinux 9 | 21.01.0-24.el9_8.1 | ALSA-2026:25058 | Jun 10, 2026 |
| poppler-cpp · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler-cpp · ol 10 | 0:24.02.0-7.el10_2.2 | ELSA-2026-24985 | Jul 16, 2026 |
| poppler-cpp · ol 8 | 0:20.11.0-14.el8_10 | ELSA-2026-24984 | Jun 10, 2026 |
| poppler-cpp · ol 9 | 0:21.01.0-24.el9_8.1 | ELSA-2026-25058 | Jun 23, 2026 |
| poppler-cpp-debuginfo · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler-cpp-devel · RHEL 8 | 0:20.11.0-14.el8_10 | RHSA-2026:24984 | Jun 24, 2026 |
| poppler-cpp-devel · RHEL 9 | 0:21.01.0-24.el9_8.1 | RHSA-2026:25058 | Jun 24, 2026 |
| poppler-cpp-devel · almalinux 10 | 24.02.0-7.el10_2.2 | ALSA-2026:24985 | Jun 10, 2026 |
| poppler-cpp-devel · almalinux 8 | 20.11.0-14.el8_10 | ALSA-2026:24984 | Jun 10, 2026 |
| poppler-cpp-devel · almalinux 9 | 21.01.0-24.el9_8.1 | ALSA-2026:25058 | Jun 10, 2026 |
| poppler-cpp-devel · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler-cpp-devel · ol 10 | 0:24.02.0-7.el10_2.2 | ELSA-2026-24985 | Jul 16, 2026 |
| poppler-cpp-devel · ol 8 | 0:20.11.0-14.el8_10 | ELSA-2026-24984 | Jun 10, 2026 |
| poppler-cpp-devel · ol 9 | 0:21.01.0-24.el9_8.1 | ELSA-2026-25058 | Jun 23, 2026 |
| poppler-debuginfo · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler-debugsource · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler-devel · RHEL 8 | 0:20.11.0-14.el8_10 | RHSA-2026:24984 | Jun 24, 2026 |
| poppler-devel · RHEL 9 | 0:21.01.0-24.el9_8.1 | RHSA-2026:25058 | Jun 24, 2026 |
| poppler-devel · almalinux 10 | 24.02.0-7.el10_2.2 | ALSA-2026:24985 | Jun 10, 2026 |
| poppler-devel · almalinux 8 | 20.11.0-14.el8_10 | ALSA-2026:24984 | Jun 10, 2026 |
| poppler-devel · almalinux 9 | 21.01.0-24.el9_8.1 | ALSA-2026:25058 | Jun 10, 2026 |
| poppler-devel · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler-devel · ol 10 | 0:24.02.0-7.el10_2.2 | ELSA-2026-24985 | Jul 16, 2026 |
| poppler-devel · ol 8 | 0:20.11.0-14.el8_10 | ELSA-2026-24984 | Jun 10, 2026 |
| poppler-devel · ol 9 | 0:21.01.0-24.el9_8.1 | ELSA-2026-25058 | Jun 23, 2026 |
| poppler-glib · RHEL 8 | 0:20.11.0-14.el8_10 | RHSA-2026:24984 | Jun 24, 2026 |
| poppler-glib · RHEL 9 | 0:21.01.0-24.el9_8.1 | RHSA-2026:25058 | Jun 24, 2026 |
| poppler-glib · almalinux 10 | 24.02.0-7.el10_2.2 | ALSA-2026:24985 | Jun 10, 2026 |
| poppler-glib · almalinux 8 | 20.11.0-14.el8_10 | ALSA-2026:24984 | Jun 10, 2026 |
| poppler-glib · almalinux 9 | 21.01.0-24.el9_8.1 | ALSA-2026:25058 | Jun 10, 2026 |
| poppler-glib · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler-glib · ol 10 | 0:24.02.0-7.el10_2.2 | ELSA-2026-24985 | Jul 16, 2026 |
| poppler-glib · ol 8 | 0:20.11.0-14.el8_10 | ELSA-2026-24984 | Jun 10, 2026 |
| poppler-glib · ol 9 | 0:21.01.0-24.el9_8.1 | ELSA-2026-25058 | Jun 23, 2026 |
| poppler-glib-debuginfo · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler-glib-devel · RHEL 8 | 0:20.11.0-14.el8_10 | RHSA-2026:24984 | Jun 24, 2026 |
| poppler-glib-devel · RHEL 9 | 0:21.01.0-24.el9_8.1 | RHSA-2026:25058 | Jun 24, 2026 |
| poppler-glib-devel · almalinux 10 | 24.02.0-7.el10_2.2 | ALSA-2026:24985 | Jun 10, 2026 |
| poppler-glib-devel · almalinux 8 | 20.11.0-14.el8_10 | ALSA-2026:24984 | Jun 10, 2026 |
| poppler-glib-devel · almalinux 9 | 21.01.0-24.el9_8.1 | ALSA-2026:25058 | Jun 10, 2026 |
| poppler-glib-devel · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler-glib-devel · ol 10 | 0:24.02.0-7.el10_2.2 | ELSA-2026-24985 | Jul 16, 2026 |
| poppler-glib-devel · ol 8 | 0:20.11.0-14.el8_10 | ELSA-2026-24984 | Jun 10, 2026 |
| poppler-glib-devel · ol 9 | 0:21.01.0-24.el9_8.1 | ELSA-2026-25058 | Jun 23, 2026 |
| poppler-glib-doc · RHEL 8 | 0:20.11.0-14.el8_10 | RHSA-2026:24984 | Jun 24, 2026 |
| poppler-glib-doc · RHEL 9 | 0:21.01.0-24.el9_8.1 | RHSA-2026:25058 | Jun 24, 2026 |
| poppler-glib-doc · almalinux 10 | 24.02.0-7.el10_2.2 | ALSA-2026:24985 | Jun 10, 2026 |
| poppler-glib-doc · almalinux 8 | 20.11.0-14.el8_10 | ALSA-2026:24984 | Jun 10, 2026 |
| poppler-glib-doc · almalinux 9 | 21.01.0-24.el9_8.1 | ALSA-2026:25058 | Jun 10, 2026 |
| poppler-glib-doc · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler-glib-doc · ol 10 | 0:24.02.0-7.el10_2.2 | ELSA-2026-24985 | Jul 16, 2026 |
| poppler-glib-doc · ol 8 | 0:20.11.0-14.el8_10 | ELSA-2026-24984 | Jun 10, 2026 |
| poppler-glib-doc · ol 9 | 0:21.01.0-24.el9_8.1 | ELSA-2026-25058 | Jun 23, 2026 |
| poppler-qt5 · RHEL 8 | 0:20.11.0-14.el8_10 | RHSA-2026:24984 | Jun 24, 2026 |
| poppler-qt5 · RHEL 9 | 0:21.01.0-24.el9_8.1 | RHSA-2026:25058 | Jun 24, 2026 |
| poppler-qt5 · almalinux 8 | 20.11.0-14.el8_10 | ALSA-2026:24984 | Jun 10, 2026 |
| poppler-qt5 · almalinux 9 | 21.01.0-24.el9_8.1 | ALSA-2026:25058 | Jun 10, 2026 |
| poppler-qt5 · ol 8 | 0:20.11.0-14.el8_10 | ELSA-2026-24984 | Jun 10, 2026 |
| poppler-qt5 · ol 9 | 0:21.01.0-24.el9_8.1 | ELSA-2026-25058 | Jun 23, 2026 |
| poppler-qt5-devel · RHEL 8 | 0:20.11.0-14.el8_10 | RHSA-2026:24984 | Jun 24, 2026 |
| poppler-qt5-devel · RHEL 9 | 0:21.01.0-24.el9_8.1 | RHSA-2026:25058 | Jun 24, 2026 |
| poppler-qt5-devel · almalinux 8 | 20.11.0-14.el8_10 | ALSA-2026:24984 | Jun 10, 2026 |
| poppler-qt5-devel · almalinux 9 | 21.01.0-24.el9_8.1 | ALSA-2026:25058 | Jun 10, 2026 |
| poppler-qt5-devel · ol 8 | 0:20.11.0-14.el8_10 | ELSA-2026-24984 | Jun 10, 2026 |
| poppler-qt5-devel · ol 9 | 0:21.01.0-24.el9_8.1 | ELSA-2026-25058 | Jun 23, 2026 |
| poppler-qt6 · almalinux 10 | 24.02.0-7.el10_2.2 | ALSA-2026:24985 | Jun 10, 2026 |
| poppler-qt6 · ol 10 | 0:24.02.0-7.el10_2.2 | ELSA-2026-24985 | Jul 16, 2026 |
| poppler-qt6-devel · almalinux 10 | 24.02.0-7.el10_2.2 | ALSA-2026:24985 | Jun 10, 2026 |
| poppler-qt6-devel · ol 10 | 0:24.02.0-7.el10_2.2 | ELSA-2026-24985 | Jul 16, 2026 |
| poppler-utils · RHEL 8 | 0:20.11.0-14.el8_10 | RHSA-2026:24984 | Jun 24, 2026 |
| poppler-utils · RHEL 9 | 0:21.01.0-24.el9_8.1 | RHSA-2026:25058 | Jun 24, 2026 |
| poppler-utils · Ubuntu 22.04.1 LTS (jammy) | 22.02.0-2ubuntu0.13 | poppler-utils 22.02.0-2ubuntu0.13 | Jun 24, 2026 |
| poppler-utils · Ubuntu 24.04.5 LTS (noble) | 24.02.0-1ubuntu9.9 | poppler-utils 24.02.0-1ubuntu9.9 | Jun 24, 2026 |
| poppler-utils · Ubuntu 25.10 (questing) | 25.03.0-10ubuntu0.2 | poppler-utils 25.03.0-10ubuntu0.2 | Jun 24, 2026 |
| poppler-utils · Ubuntu 26.04.1 LTS (resolute) | 26.01.0-2ubuntu0.1 | poppler-utils 26.01.0-2ubuntu0.1 | Jun 1, 2026 |
| poppler-utils · almalinux 10 | 24.02.0-7.el10_2.2 | ALSA-2026:24985 | Jun 10, 2026 |
| poppler-utils · almalinux 8 | 20.11.0-14.el8_10 | ALSA-2026:24984 | Jun 10, 2026 |
| poppler-utils · almalinux 9 | 21.01.0-24.el9_8.1 | ALSA-2026:25058 | Jun 10, 2026 |
| poppler-utils · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
| poppler-utils · ol 10 | 0:24.02.0-7.el10_2.2 | ELSA-2026-24985 | Jul 16, 2026 |
| poppler-utils · ol 8 | 0:20.11.0-14.el8_10 | ELSA-2026-24984 | Jun 10, 2026 |
| poppler-utils · ol 9 | 0:21.01.0-24.el9_8.1 | ELSA-2026-25058 | Jun 23, 2026 |
| poppler-utils-debuginfo · amzn 2023 | 24.08.0-1.amzn2023.0.1 | ALAS2023-2026-1852 | Jun 22, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.