CVE-2026-93653: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-93653 is a denial-of-service vulnerability in Poppler's Splash rendering backend, caused by an unchecked loop condition in the SplashOutputDev::tilingPatternFill function. A specially crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause the function to compute an attacker-controlled repeat count, driving an excessively long loop in the pattern-fill scanline routine without a corresponding memory allocation. The vulnerability affects Poppler (including compat-poppler022) as shipped by Red Hat across multiple product lines; confirmed reproducible on Poppler versions 26.04.0, 26.06.0, 26.08.0, and current master. It was disclosed on September 18, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-606 (Unchecked Input for Loop Condition). In SplashOutputDev::tilingPatternFill (poppler/SplashOutputDev.cc), the computed repeat count (repeatX/repeatY) is derived directly from PDF-controlled tiling-pattern geometry (fill rectangle and step values). When the raw span (x1 - x0 / y1 - y0) exceeds the value derived from surface dimensions, it is substituted directly into repeatX/repeatY, allowing values bounded only by INT_MAX (~2^31). This drives an unconditional, unclipped loop in the tilingBitmapSrc scanline callback that executes once per output scanline. Notably, this is a residual flaw distinct from CVE-2026-10118: the checkedMultiply() guard added by that fix only rejects overflow cases where surface_width * repeatX exceeds INT_MAX, but does not bound repeatX/repeatY when the product fits under INT_MAX — the exact condition exploited here. Exploitation requires only that a user or automated process open a malicious ~820-byte crafted PDF with an application using Poppler's Splash backend (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes the rendering process to consume 100% of a CPU core for an attacker-controlled, extended duration, resulting in a denial of service. Memory usage remains flat (the source tile bitmap stays small), making the attack difficult to detect via memory monitoring alone. Any application using Poppler's Splash backend to render untrusted PDFs is affected, including pdftoppm, document preview tools, mail-gateway attachment scanners, and OCR pipelines — each submitted malicious PDF can pin one CPU core indefinitely. There is no confidentiality or integrity impact (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The NVD SSVC assessment indicates exploitation is "none" and the attack is not automatable, as user interaction (opening a malicious PDF) is required. The EPSS score is 0.0, reflecting a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat CVE, GitHub Advisory).

1. Craft malicious PDF: Construct a PDF (as small as ~820 bytes) containing a tiling pattern whose fill rectangle and step geometry produce a repeatX or repeatY value approaching INT_MAX when processed by SplashOutputDev::tilingPatternFill. The geometry must be tuned so that surface_width * repeatX does not overflow INT_MAX (bypassing the checkedMultiply() guard from CVE-2026-10118), but repeatX itself is extremely large.
2. Deliver the PDF: Send the crafted PDF to a target via email attachment, web upload, shared storage, or any channel where it will be processed by an application using Poppler's Splash backend (e.g., pdftoppm, a document preview service, a mail-gateway scanner, or an OCR pipeline).
3. Trigger rendering: Induce the target application to render the PDF — this may happen automatically (e.g., mail-gateway thumbnail generation) or require a user to open the file.
4. Achieve denial of service: The tilingBitmapSrc scanline callback enters an unconditional loop executing once per output scanline for the attacker-controlled repeat count, consuming 100% of one CPU core for an extended, attacker-controlled duration without significant memory growth (Red Hat Bugzilla, Red Hat CVE).

• Process: A Poppler-based process (e.g., pdftoppm, evince, okular, or a mail-gateway/OCR worker) sustaining 100% CPU utilization for an abnormally long duration while processing a single PDF file.
• File System: Presence of small (~820-byte), syntactically valid PDF files with unusual tiling-pattern geometry in upload directories, mail spool, or temporary processing folders.
• Logs: Application or system logs showing a Poppler rendering process that started but did not complete within expected time bounds for a given PDF; repeated processing attempts of the same small PDF file.
• Network: Unexpected inbound delivery of very small PDF files (under 1 KB) to mail gateways, web upload endpoints, or document processing services, particularly from external or untrusted sources.

Red Hat's primary recommended mitigation is to avoid opening or processing untrusted PDF files with applications that rely on Poppler's Splash backend. Patches have been tracked via Red Hat Bugzilla (Bug 2537005), and affected products include Red Hat Enterprise Linux packages poppler and compat-poppler022; users should apply errata updates as they become available. As an operational control, organizations can restrict which sources are permitted to submit PDFs to automated processing pipelines (mail gateways, OCR services, document preview systems) and implement timeouts or resource limits (e.g., CPU time limits via ulimit or cgroup controls) on Poppler-based rendering processes to bound the impact of exploitation (Red Hat CVE, Red Hat Bugzilla).

Red Hat classified this as a "Moderate" impact flaw and acknowledged the reporter, Donghai Zhu of the School of Computer Science and Technology, Zhejiang Gongshang University. Red Hat's advisory notes that the flaw is a residual, distinct consequence of the same arithmetic defect addressed by CVE-2026-10118, highlighting that the prior fix's checkedMultiply() guard was insufficient to fully remediate the underlying issue (Red Hat CVE).