A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1852 advisory.

    A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by     crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill`     function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds     write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial     of service within the context of the application processing the PDF. (CVE-2026-10118)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1851 advisory.

    A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by     crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill`     function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds     write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial     of service within the context of the application processing the PDF. (CVE-2026-10118)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3362 advisory.

    A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by     crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill`     function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds     write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial     of service within the context of the application processing the PDF. (CVE-2026-10118)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:27721 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:27722 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:27723 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:27720 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:27725 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:27727 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:27724 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0159 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-10118:
    A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by     crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill`     function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds     write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial     of service within the context of the application processing the PDF.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:24985 advisory.

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:25058 advisory.

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:24984 advisory.

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:25058 advisory.

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:24985 advisory.

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-780:03 advisory.

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:24984 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:25058 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:24985 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-24984 advisory.

    - Fix integer overflow in tilingPatternFill (CVE-2026-10118)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:24984 advisory.

    * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow     via unchecked dimension multiplication (CVE-2026-10118)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8400-1 advisory.

    It was discovered that poppler incorrectly handled certain malformed PDF tiling patterns in the Splash     backend. An attacker could possibly use this issue to execute arbitrary code, obtain sensitive     information, or cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6334 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6334-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     June 09, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : poppler     CVE ID         : CVE-2025-43718 CVE-2025-52885 CVE-2026-10118     Debian Bug     : 1117046 1117853 1138708

    Several vulnerabilities were discovered in poppler, a PDF rendering     library, which could result in denial of service, information     disclosure, or potentially the execution of arbitrary code if a     specially crafted file is processed.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 22.12.0-2+deb12u2.

    For the stable distribution (trixie), these problems have been fixed in     version 25.03.0-5+deb13u3.

    We recommend that you upgrade your poppler packages.

    For the detailed security status of poppler please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/poppler

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by     crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill`     function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds     write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial     of service within the context of the application processing the PDF. (CVE-2026-10118)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
322100	Amazon Linux 2023 : poppler, poppler-cpp, poppler-cpp-devel (ALAS2023-2026-1852)	Nessus	Amazon Linux Local Security Checks	high
322094	Amazon Linux 2023 : compat-poppler22, compat-poppler22-cpp (ALAS2023-2026-1851)	Nessus	Amazon Linux Local Security Checks	high
322073	Amazon Linux 2 : poppler, --advisory ALAS2-2026-3362 (ALAS-2026-3362)	Nessus	Amazon Linux Local Security Checks	high
321947	RHEL 9 : poppler (RHSA-2026:27721)	Nessus	Red Hat Local Security Checks	high
321944	RHEL 9 : poppler (RHSA-2026:27722)	Nessus	Red Hat Local Security Checks	high
321936	RHEL 9 : poppler (RHSA-2026:27723)	Nessus	Red Hat Local Security Checks	high
321903	RHEL 10 : poppler (RHSA-2026:27720)	Nessus	Red Hat Local Security Checks	high
321899	RHEL 8 : poppler (RHSA-2026:27725)	Nessus	Red Hat Local Security Checks	high
321897	RHEL 8 : poppler (RHSA-2026:27727)	Nessus	Red Hat Local Security Checks	high
321896	RHEL 8 : poppler (RHSA-2026:27724)	Nessus	Red Hat Local Security Checks	high
321236	Alibaba Cloud Linux 3 : 0159: poppler (ALINUX3-SA-2026:0159)	Nessus	Alibaba Cloud Linux Local Security Checks	high
320951	RockyLinux 10 : poppler (RLSA-2026:24985)	Nessus	Rocky Linux Local Security Checks	high
320942	RockyLinux 9 : poppler (RLSA-2026:25058)	Nessus	Rocky Linux Local Security Checks	high
320757	RockyLinux 8 : poppler (RLSA-2026:24984)	Nessus	Rocky Linux Local Security Checks	high
320650	AlmaLinux 9 : poppler (ALSA-2026:25058)	Nessus	Alma Linux Local Security Checks	high
320622	AlmaLinux 10 : poppler (ALSA-2026:24985)	Nessus	Alma Linux Local Security Checks	high
320533	MiracleLinux 8 : poppler-20.11.0-14.el8_10 (AXSA:2026-780:03)	Nessus	Miracle Linux Local Security Checks	high
320452	RHEL 8 : poppler (RHSA-2026:24984)	Nessus	Red Hat Local Security Checks	high
320450	RHEL 9 : poppler (RHSA-2026:25058)	Nessus	Red Hat Local Security Checks	high
320449	RHEL 10 : poppler (RHSA-2026:24985)	Nessus	Red Hat Local Security Checks	high
320438	Oracle Linux 8 : poppler (ELSA-2026-24984)	Nessus	Oracle Linux Local Security Checks	high
320437	AlmaLinux 8 : poppler (ALSA-2026:24984)	Nessus	Alma Linux Local Security Checks	high
320396	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : poppler vulnerability (USN-8400-1)	Nessus	Ubuntu Local Security Checks	high
320215	Debian dsa-6334 : gir1.2-poppler-0.18 - security update	Nessus	Debian Local Security Checks	high
318223	Linux Distros Unpatched Vulnerability : CVE-2026-10118	Nessus	Misc.	high

Detections

Analytics

CVE-2026-10118

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high