CVE-2026-93312

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93312
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93312.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93312
Downstream
Published
2026-09-18T00:45:12Z
Modified
2026-09-19T03:47:30Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference
Details

A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-404",
        "CWE-476"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93312.json"
}
References

Affected packages

Git / gitlab.freedesktop.org/poppler/poppler

Affected ranges

Type
GIT
Repo
https://gitlab.freedesktop.org/poppler/poppler
Events
Introduced
b7989c187daee307b782ac4592cddb1ae0677b76
Fixed
5e49250f13b0390edeb3f90eb4c02c9941f97067
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "26.07.0"
        },
        {
            "last_affected": "26.07.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

26.*
26.07.0
poppler-26.*
poppler-26.07.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93312.json"