USN-8950-1: Ubuntu patches buffer overflow in poppler

Ubuntu published security notice USN-8950-1 on 21 October 2026 for a vulnerability in the poppler library, used for rendering and processing PDF files. It affects all currently supported releases: 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS. For those managing Ubuntu servers it matters because poppler is often a dependency of document conversion tools, invoice generation scripts or panels that produce PDFs server-side.

What the notice says

According to the official advisory, the fix concerns a stack overflow related to a long password, correctly applying the password length limit in poppler/Decrypt.cc. The issue is tracked as CVE-2026-107705.

Going into the technical details published in the CVE database, it is a stack-based buffer overflow in Decrypt::revision6Hash() that allows whoever controls the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Specifically, an attacker can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ APIs, causing overflow of the K1 and E buffers, with resulting process crash or memory corruption.

On the severity front, public ratings indicate a CVSS 3.1 of 6.5 out of 10 and a CVSS 4.0 of 8.3 out of 10, with impact limited to availability and integrity.

Patched versions and how to update

Ubuntu Release	Package	Patched version
26.10 (stonking)	libpoppler162	26.07.0-2ubuntu1.1
26.04 LTS (resolute)	libpoppler156	26.01.0-2ubuntu0.3
24.04 LTS (noble)	libpoppler134	24.02.0-1ubuntu9.11
22.04 LTS (jammy)	libpoppler118	22.02.0-2ubuntu0.15

The update is applied with a standard apt update && apt upgrade. Those using Ubuntu Pro get extended security coverage for up to ten years even on Universe packages; the plan is free for up to five machines.

No known public exploits were reported at the time of the advisory's publication.