CVE-2020-35702

HIGH

Poppler - Heap-Based Buffer Overflow in DCTStream::getChars

Title source: llm
STIX 2.1

Description

DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects

References (1)

Core 1
Core References
Exploit, Vendor Advisory x_refsource_misc
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1011

Scores

CVSS v3 7.8
EPSS 0.0086
EPSS Percentile 54.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (1)
freedesktop/poppler 20.12.1
Published Dec 25, 2020
Tracked Since Feb 18, 2026