{"schema":"threatline.record/2","record":{"id":"CVE-2026-102620","aliases":[],"summary":"Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow","details":"A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.","categories":["Unclassified"],"product":"Poppler","vendor":"Freedesktop","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102620","source_modified_at":"2026-10-02T12:26:30.155Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Poppler","vendor":"Freedesktop","versions":[{"version":"26.06.0","status":"affected"},{"version":"26.07.0","status":"affected"},{"version":"26.08.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":4.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00115,"percentile":0.01484,"score_date":"2026-10-23"},"published_at":"2026-09-29T20:30:15.183Z","modified_at":"2026-10-02T12:26:30.155Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-102620","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-02T12:26:30.155Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102620","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://vuldb.com/vuln/411410","tags":["vdb-entry","technical-description"]},{"source":"CVE List","url":"https://vuldb.com/vuln/411410/cti","tags":["signature","permissions-required"]},{"source":"CVE List","url":"https://vuldb.com/cve/CVE-2026-102620","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://vuldb.com/submit/942348","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1762","tags":["related"]},{"source":"CVE List","url":"https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2326","tags":["patch"]},{"source":"CVE List","url":"https://github.com/r1ck9-2q/cve_summit/blob/main/Signed-integer-overflow-in-FoFiTrueType-cvtSfnts-FoFiTrueType.cc-1210.md","tags":["exploit"]},{"source":"CVE List","url":"https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fdddd010279c6ed94d","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-02T12:26:14.191611Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-02T12:26:30.155Z","content_hash":"04f5ea067943319af0fc99dd81085df33d575eedbad28f6db608e5e42819589d"}}