Bug#1148267: poppler: CVE-2026-93311

[Moritz Mühlenhoff]

Source: poppler
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for poppler.

CVE-2026-93311[0]:
| A vulnerability was detected in Freedesktop Poppler 26.07.0. This
| issue affects the function SampledFunction::SampledFunction of the
| file poppler/Function.cc of the component SampledFunction. The
| manipulation of the argument BitsPerSample results in integer
| overflow. The attack may be performed from remote. The exploit is
| now public and may be used. The project was informed of the problem
| early through a bug report but has not responded yet.

https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1758


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-93311
    https://www.cve.org/CVERecord?id=CVE-2026-93311

Please adjust the affected versions in the BTS as needed.