Red Hat Hardened Images Update Poppler for PDF Decryption Overflow
Tech GuruQuick Answer
The authority published RHSA-2026:80172 for Red Hat Hardened Images poppler RPM family on aarch64 and x86_64. Red Hat fixed a stack-based buffer overflow in Poppler PDF decryption. Opening an untrusted password-protected PDF and supplying an excessively long password can cause an application crash or memory corruption; Red Hat assesses the practical impact primarily as denial of service under its default hardening. Affected deployments should be matched to the authority's exact scope and moved to the supported fixed release.
Rebuild And Redeploy The Supported Hardened Image
What to do now: Inventory images and workloads containing the affected RPM family, replace them with content carrying poppler-26.08.0-1.3.hum1, redeploy through the supported image pipeline, validate service behavior, and retain package and image-digest evidence.
Last verified: 2026-10-10 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat Hardened Images poppler RPM family on aarch64 and x86_64 |
|---|---|
| Advisory | RHSA-2026:80172 |
| CVE | CVE-2026-107705 |
| Authoritative release date | 2026-10-09 18:31:41 UTC |
| Authority revision date | 2026-10-09 23:27:23 UTC |
| Affected versions | Red Hat Hardened Images containing the advisory-listed poppler, poppler-cpp, poppler-glib, poppler-qt6, poppler-utils, or development RPMs before release 26.08.0-1.3.hum1. |
| Fixed version | the advisory-listed poppler RPM family at 26.08.0-1.3.hum1 for aarch64 or x86_64, using supported Red Hat Hardened Images content |
| CVSS base score | 5.5 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Red Hat fixed a stack-based buffer overflow in Poppler PDF decryption. Opening an untrusted password-protected PDF and supplying an excessively long password can cause an application crash or memory corruption; Red Hat assesses the practical impact primarily as denial of service under its default hardening.
What To Validate Now
- Inventory. Locate Red Hat Hardened Images poppler RPM family on aarch64 and x86_64, including registries, build pipelines, derived images, clusters, workload owners, and the RPM NEVRA and image digest actually deployed.
- Establish applicability. Match the exact Red Hat Hardened Images RPM and architecture statement: Red Hat Hardened Images containing the advisory-listed poppler, poppler-cpp, poppler-glib, poppler-qt6, poppler-utils, or development RPMs before release 26.08.0-1.3.hum1. Do not apply this advisory to upstream packages or unrelated Red Hat products without authority evidence.
- Remediate. Use the advisory-listed poppler RPM family at 26.08.0-1.3.hum1 for aarch64 or x86_64, using supported Red Hat Hardened Images content or supported superseding content, rebuild derived images, and redeploy every affected workload. Red Hat states that no acceptable workaround is available.
- Validate. Confirm package NEVRAs and immutable image digests in the registry and running workloads, exercise representative application behavior, monitor resource use and restarts, and verify rollback readiness.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use Red Hat's supported Hardened Images content and confirm every rebuilt image digest and deployed workload. No acceptable workaround is available. Test PDF-processing workflows and preserve image, package, rollout, and validation evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
