CVE-2026-93314 Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow
An integer overflow in Poppler's TrueType font processing allows remote attackers to cause denial of service or potentially execute code via crafted PDF files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-93314?
CVE-2026-93314 is a medium-severity vulnerability in Freedesktop Poppler, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.
Which versions are affected by CVE-2026-93314?
How do I fix CVE-2026-93314?
Apply the vendor's patch.
Is CVE-2026-93314 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93314 exists.
Sources
Also known as DEBIAN-CVE-2026-93314, ECHO-6f38-4ab4-57a4, GHSA-2g5c-g4rf-f9jv, UBUNTU-CVE-2026-93314.