Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8950-1 advisory.

    It was discovered that poppler incorrectly handled the password length limit when decrypting certain     encrypted PDF files. An attacker could possibly use this issue to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that     allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs.
    Attackers can supply a password longer than 127 bytes through applications using the libpoppler,     libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
    (CVE-2026-107705)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that
    allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs.
    Attackers can supply a password longer than 127 bytes through applications using the libpoppler,
    libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
    (CVE-2026-107705)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791810115 advisory.

  - Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that     allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs.
    Attackers can supply a password longer than 127 bytes through applications using the libpoppler,     libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
    (CVE-2026-107705)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791810115 advisory.

  - Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that     allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs.
    Attackers can supply a password longer than 127 bytes through applications using the libpoppler,     libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
    (CVE-2026-107705)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
370516	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : poppler vulnerability (USN-8950-1)	Nessus	Ubuntu Local Security Checks	Local	high
369132	Linux Distros Unpatched Vulnerability : CVE-2026-107705	Nessus	Misc.	Local	high
474794	Echo: poppler: security update to 25.03.0-5+deb13u4+e3	Tenable Cloud Security	Echo Local Security Checks	Local	high
474794	Echo: poppler: security update to 25.03.0-5+deb13u4+e3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
364714	AlmaLinux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1791810115)	Nessus	Alma Linux Local Security Checks	Local	high
364713	Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1791810115)	Nessus	Rocky Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-107705

high

Tenable Plugins

high

high

high

high

high

high