CVE-2026-10118 Integer overflow in Red Hat AI Inference Server 3.3

High 7.8 Published 1 Jun 2026 Updated 2 Oct 2026

A remote attacker can execute arbitrary code or cause denial of service by tricking a user into opening a malicious PDF file that triggers an integer overflow in Poppler.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-10118?

CVE-2026-10118 is a high-severity vulnerability in Red Hat AI Inference Server 3.3, published on 1 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

Weakness: CWE-190

Which versions are affected by CVE-2026-10118?

Linux distribution packages (40)

`poppler` AlmaLinux:10	All versions	`24.02.0-7.el10_2.2`
`poppler-cpp` AlmaLinux:10	All versions	`24.02.0-7.el10_2.2`
`poppler-cpp-devel` AlmaLinux:10	All versions	`24.02.0-7.el10_2.2`
`poppler-devel` AlmaLinux:10	All versions	`24.02.0-7.el10_2.2`
`poppler-glib` AlmaLinux:10	All versions	`24.02.0-7.el10_2.2`
`poppler-glib-devel` AlmaLinux:10	All versions	`24.02.0-7.el10_2.2`
`poppler-glib-doc` AlmaLinux:10	All versions	`24.02.0-7.el10_2.2`
`poppler-qt6` AlmaLinux:10	All versions	`24.02.0-7.el10_2.2`
`poppler-qt6-devel` AlmaLinux:10	All versions	`24.02.0-7.el10_2.2`
`poppler-utils` AlmaLinux:10	All versions	`24.02.0-7.el10_2.2`
`poppler` AlmaLinux:8	All versions	`20.11.0-14.el8_10`
`poppler-cpp` AlmaLinux:8	All versions	`20.11.0-14.el8_10`
`poppler-cpp-devel` AlmaLinux:8	All versions	`20.11.0-14.el8_10`
`poppler-devel` AlmaLinux:8	All versions	`20.11.0-14.el8_10`
`poppler-glib` AlmaLinux:8	All versions	`20.11.0-14.el8_10`
`poppler-glib-devel` AlmaLinux:8	All versions	`20.11.0-14.el8_10`
`poppler-glib-doc` AlmaLinux:8	All versions	`20.11.0-14.el8_10`
`poppler-qt5` AlmaLinux:8	All versions	`20.11.0-14.el8_10`
`poppler-qt5-devel` AlmaLinux:8	All versions	`20.11.0-14.el8_10`
`poppler-utils` AlmaLinux:8	All versions	`20.11.0-14.el8_10`
`poppler` AlmaLinux:9	All versions	`21.01.0-24.el9_8.1`
`poppler-cpp` AlmaLinux:9	All versions	`21.01.0-24.el9_8.1`
`poppler-cpp-devel` AlmaLinux:9	All versions	`21.01.0-24.el9_8.1`
`poppler-devel` AlmaLinux:9	All versions	`21.01.0-24.el9_8.1`
`poppler-glib` AlmaLinux:9	All versions	`21.01.0-24.el9_8.1`
`poppler-glib-devel` AlmaLinux:9	All versions	`21.01.0-24.el9_8.1`
`poppler-glib-doc` AlmaLinux:9	All versions	`21.01.0-24.el9_8.1`
`poppler-qt5` AlmaLinux:9	All versions	`21.01.0-24.el9_8.1`
`poppler-qt5-devel` AlmaLinux:9	All versions	`21.01.0-24.el9_8.1`
`poppler-utils` AlmaLinux:9	All versions	`21.01.0-24.el9_8.1`
`poppler` Red Hat:enterprise_linux:10.2	All versions	`0:24.02.0-7.el10_2.2`
`poppler-cpp` Red Hat:enterprise_linux:10.2	All versions	`0:24.02.0-7.el10_2.2`
`poppler-cpp-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:24.02.0-7.el10_2.2`
`poppler-cpp-devel` Red Hat:enterprise_linux:10.2	All versions	`0:24.02.0-7.el10_2.2`
`poppler-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:24.02.0-7.el10_2.2`
`poppler-debugsource` Red Hat:enterprise_linux:10.2	All versions	`0:24.02.0-7.el10_2.2`
`poppler-devel` Red Hat:enterprise_linux:10.2	All versions	`0:24.02.0-7.el10_2.2`
`poppler-glib` Red Hat:enterprise_linux:10.2	All versions	`0:24.02.0-7.el10_2.2`
`poppler-glib-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:24.02.0-7.el10_2.2`
`poppler-glib-devel` Red Hat:enterprise_linux:10.2	All versions	`0:24.02.0-7.el10_2.2`

How do I fix CVE-2026-10118?

Apply the vendor's patch.

Is CVE-2026-10118 being exploited?

There is no known exploitation of CVE-2026-10118 in the wild and no public exploit code.

Sources

Also known as ALSA-2026:24984, ALSA-2026:24985, ALSA-2026:25058, BELL-CVE-2026-10118, CLSA-2026-1781354122, CLSA-2026-1781514933 and 27 more.