CVE-2026-93313 Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow
An integer overflow in Poppler's JBIG2Stream allows remote attackers to cause denial of service or potentially execute code via crafted PDF files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-93313?
CVE-2026-93313 is a medium-severity vulnerability in Freedesktop Poppler, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch.
Which versions are affected by CVE-2026-93313?
Linux distribution packages (10)
poppler Red Hat:hummingbird:1 | All versions | 0:26.08.0-1.1.hum1 |
poppler-cpp Red Hat:hummingbird:1 | All versions | 0:26.08.0-1.1.hum1 |
poppler-cpp-devel Red Hat:hummingbird:1 | All versions | 0:26.08.0-1.1.hum1 |
poppler-devel Red Hat:hummingbird:1 | All versions | 0:26.08.0-1.1.hum1 |
poppler-glib Red Hat:hummingbird:1 | All versions | 0:26.08.0-1.1.hum1 |
poppler-glib-devel Red Hat:hummingbird:1 | All versions | 0:26.08.0-1.1.hum1 |
poppler-glib-doc Red Hat:hummingbird:1 | All versions | 0:26.08.0-1.1.hum1 |
poppler-qt6 Red Hat:hummingbird:1 | All versions | 0:26.08.0-1.1.hum1 |
poppler-qt6-devel Red Hat:hummingbird:1 | All versions | 0:26.08.0-1.1.hum1 |
poppler-utils Red Hat:hummingbird:1 | All versions | 0:26.08.0-1.1.hum1 |
How do I fix CVE-2026-93313?
Apply the vendor's patch.
Is CVE-2026-93313 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93313 exists.
Sources
Also known as DEBIAN-CVE-2026-93313, ECHO-1b3a-1546-b4ee, GHSA-xj93-32pj-8pfj, RHSA-2026:71625, UBUNTU-CVE-2026-93313.