Freedesktop vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20255
3. 20268

Newest CVEs

• CVE-2026-107705

  Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()

  freedesktop · poppler

  High8.3
• CVE-2026-102621

  Freedesktop Poppler SplashClip.cc clipToPath integer overflow

  Freedesktop · Poppler

  Medium4.8
• CVE-2026-102620

  Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow

  Freedesktop · Poppler

  Medium4.8
• CVE-2026-93314

  Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow

  Freedesktop · Poppler

  Medium5.3
• CVE-2026-93313

  Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow

  Freedesktop · Poppler

  Medium5.3
• CVE-2026-93312

  Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference

  Freedesktop · Poppler

  Medium5.3
• CVE-2026-93311

  Freedesktop Poppler SampledFunction Function.cc integer overflow

  Freedesktop · Poppler

  Medium5.3
• CVE-2026-50292

  In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code…

  freedesktop · libinput

  High7.4
• CVE-2025-43718

  Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion)…

  freedesktop · Poppler

  Low2.9
• CVE-2025-52968

  xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified…

  freedesktop · xdg-utils

  Low2.7