Bug#1150515: poppler: CVE-2026-107705

[Salvatore Bonaccorso]

Source: poppler
Version: 26.07.0-2
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream
Forwarded: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814

Hi,

The following vulnerability was published for poppler.

CVE-2026-107705[0]:
| Poppler 0.42.0 through 26.10.0 contains a stack-based buffer
| overflow in Decrypt::revision6Hash() that allows attackers
| controlling the password to overwrite stack memory when opening
| AESV3/R6 encrypted PDFs. Attackers can supply a password longer than
| 127 bytes through applications using the libpoppler, libpoppler-glib
| or C++ API to overflow the K1 and E buffers, crashing the process or
| corrupting memory.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-107705
    https://www.cve.org/CVERecord?id=CVE-2026-107705
[1] https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814
[2] https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore