Bug 2537005 (CVE-2026-93653)

Summary: CVE-2026-93653 poppler: poppler: unbounded CPU loop in SplashOutputDev::tilingPatternFill via unvalidated tiling-pattern repeat count (denial of service)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2537011, 2537012    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-18 13:41:10 UTC 
A flaw was found in Poppler's Splash backend. In SplashOutputDev::tilingPatternFill (poppler/SplashOutputDev.cc), when a PDF's tiling pattern geometry (fill rectangle and step) drives the computed repeat count for the pattern-fill loop, the raw, PDF-controlled span (x1 - x0 / y1 - y0) is substituted directly into repeatX/repeatY whenever it exceeds the value derived from the (possibly overflowed) surface dimensions. This allows an attacker-supplied PDF to set repeatX/repeatY to a value bounded only by INT_MAX (~2^31), which then drives an unconditional, unclipped loop in the tilingBitmapSrc scanline callback that executes once per output scanline. Because the source tile bitmap itself remains tiny, memory usage stays flat while the process consumes 100% CPU for an extended period, resulting in denial of service. This is a residual, distinct consequence of the same tilingPatternFill arithmetic defect addressed by CVE-2026-10118: the checkedMultiply() guard added by that fix only rejects requests where surface_width * repeatX (or surface_height * repeatY) would overflow an int; it does not bound repeatX/repeatY to a sane value when the product happens to fit under INT_MAX, which is exactly the case exploited here. Confirmed reproducible on poppler 26.04.0, 26.06.0 (the CVE-2026-10118 fixed release), 26.08.0, and current master via an ~820-byte crafted PDF; verified against upstream source for all three references. Any application using Poppler's Splash backend to render untrusted PDFs (pdftoppm, document preview, mail-gateway attachment scanning, OCR pipelines) can be pinned to one CPU core per submitted file.