CVE-2026-10118

Discovered by AISLEPUBLISHEDCWE-190

Description

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

CVSS Base Scores

CVSS v3.1(Primary)
7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersionStatus
Red HatRed Hat Enterprise Linux 100:24.02.0-7.el10_2.2unaffected
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support0:24.02.0-7.el10_0.1unaffected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support0:0.22.5-7.el7_9unaffected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support0:0.26.5-44.el7_9unaffected
Red HatRed Hat Enterprise Linux 80:20.11.0-14.el8_10unaffected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support0:20.11.0-2.el8_4.3unaffected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On0:20.11.0-2.el8_4.3unaffected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support0:20.11.0-5.el8_6.1unaffected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On0:20.11.0-5.el8_6.1unaffected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service0:20.11.0-7.el8_8.1unaffected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions0:20.11.0-7.el8_8.1unaffected
Red HatRed Hat Enterprise Linux 90:21.01.0-24.el9_8.1unaffected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:21.01.0-15.el9_2.1unaffected
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions0:21.01.0-20.el9_4.1unaffected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support0:21.01.0-22.el9_6.1unaffected
Red HatRed Hat AI Inference Server 3.31782352950unaffected
Red HatRed Hat AI Inference Server 3.31782352919unaffected
Red HatRed Hat AI Inference Server 3.31782353093unaffected
Red HatRed Hat AI Inference Server 3.31782352847unaffected
Red HatRed Hat Hardened Images26.06.0-0.1.hum1unaffected
Red HatRed Hat OpenShift AI 3.41790703542unaffected
Red HatRed Hat Enterprise Linux 6——

Credits

  • This issue was discovered by AISLE Research and AISLE in partnership with Red Hat.

References