CVE-2026-93312: Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-18 · updated 2026-09-22
Weakness: CWE-404

Description

A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.

Affected products

poppler: 26.07.0

References

https://github.com/r1ck9-2q/cve_summit/blob/main/Null-pointer-offset-undefined-behavior-in-JBIG2Stream-rewind-JBIG2Stream.cc-1229.md
https://gitlab.freedesktop.org/poppler/poppler/-/commit/5e49250f13b0390edeb3f90eb4c02c9941f97067
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2314
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1759
https://vuldb.com/cve/CVE-2026-93312
https://vuldb.com/submit/942345
https://vuldb.com/vuln/406610
https://vuldb.com/vuln/406610/cti
https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1759
https://vuldb.com/submit/942345

Get alerted when CVE-2026-93312 or the next vulnerability affects your stack