CVE-2026-10118: vLLM PDF integer overflow enables

CISO Take

A crafted PDF can trigger an integer overflow in Poppler's Splash rendering backend (tilingPatternFill), causing an undersized heap allocation followed by an out-of-bounds write that can lead to code execution, information disclosure, or a crash in whatever process renders the file. This isn't an AI-specific flaw, but Poppler ships bundled inside Red Hat's AI Inference Server container images (vllm-cuda-rhel9, vllm-rocm-rhel9, vllm-spyre-rhel9, model-opt-cuda-rhel9), so any document-ingestion or PDF-processing step in those inference pipelines inherits the exposure — and the library carries a rough track record (74 other CVEs, 129 downstream dependents). Exploitation requires local access and user interaction (CVSS AV:L/UI:R), a public PoC already exists, and CISA's SSVC decision sits at TRACK rather than ACT/ATTEND, while the EPSS score (0.00252) is objectively low despite the 'top 83% percentile' framing — net-net this is a real but not urgent bug. Patch by updating Poppler to the fixed release referenced in the Red Hat advisories (RHSA-2026:24984/24985/25058/27720-27725/27727) across any affected container image, and until then avoid rendering untrusted PDFs through Poppler-based tooling anywhere in a document-ingestion pipeline feeding your AI stack.

Sources: NVD EPSS CISA KEV ATLAS access.redhat.com

What is the risk?

CVSS 7.8 (high) reflects severe potential impact (C:H/I:H/A:H) but real-world exploitability is tempered by the local attack vector and mandatory user interaction — an attacker cannot trigger this remotely without getting a victim (human or automated pipeline) to render the malicious file. A public PoC exists, which raises the practical exploitation bar's floor, but the very low EPSS score (0.00252), absence from CISA KEV, and a SSVC decision of TRACK (the lowest urgency tier) all indicate this is not being actively or opportunistically exploited in the wild today. The main risk driver is scale: 129 downstream dependents and bundling inside multiple Red Hat AI Inference Server variants mean a single unpatched Poppler instance could exist in many places across AI document-processing tooling.

How does the attack unfold?

Malicious PDF Delivery

Adversary crafts a PDF with a malformed tiling pattern designed to trigger a Poppler integer overflow and delivers it via upload, email, or a document-ingestion/RAG pipeline.

AML.T0010.001

User/Pipeline Triggers Rendering

A user opens the file, or an automated pipeline (e.g., a Red Hat AI Inference Server document-processing step) renders it with Poppler's Splash backend, invoking tilingPatternFill.

AML.T0011

Heap Overflow Exploitation

The integer overflow causes an undersized heap buffer allocation; the subsequent out-of-bounds write corrupts adjacent heap memory and hijacks control flow.

Code Execution / DoS Impact

Attacker achieves arbitrary code execution, information disclosure, or crashes the rendering process — potentially within the container context of an AI inference server ingesting the document.

Malicious PDF Delivery

Adversary crafts a PDF with a malformed tiling pattern designed to trigger a Poppler integer overflow and delivers it via upload, email, or a document-ingestion/RAG pipeline.

AML.T0010.001

User/Pipeline Triggers Rendering

A user opens the file, or an automated pipeline (e.g., a Red Hat AI Inference Server document-processing step) renders it with Poppler's Splash backend, invoking tilingPatternFill.

AML.T0011

Heap Overflow Exploitation

The integer overflow causes an undersized heap buffer allocation; the subsequent out-of-bounds write corrupts adjacent heap memory and hijacks control flow.

Code Execution / DoS Impact

Attacker achieves arbitrary code execution, information disclosure, or crashes the rendering process — potentially within the container context of an AI inference server ingesting the document.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
89.1K 128 dependents Pushed 2d ago 24% patched ~49d to patch Full package profile →
vLLM	pip	—	No patch
89.1K 128 dependents Pushed 2d ago 24% patched ~49d to patch Full package profile →
vLLM	pip	—	No patch
89.1K 128 dependents Pushed 2d ago 24% patched ~49d to patch Full package profile →
compat-poppler022	—	—	No patch
poppler	—	—	No patch
poppler-main	—	—	No patch
rhaiis/model-opt-cuda-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

Update Poppler to the patched version referenced in the vendor advisories (RHSA-2026:24984, 24985, 25058, 27720-27725, 27727) and rebuild/repull any Red Hat AI Inference Server container images (rhaiis/vllm-cuda-rhel9, vllm-rocm-rhel9, vllm-spyre-rhel9, model-opt-cuda-rhel9) once fixed builds are available. Until patched, avoid rendering untrusted or user-supplied PDFs with Splash-based Poppler tooling in any document-ingestion or RAG-loading step; run PDF rendering in a sandboxed/unprivileged process or container with seccomp and no network egress to limit blast radius. As a detection signal, monitor for unexpected crashes, segfaults, or OOM events in PDF-processing worker processes, which can indicate failed or successful overflow attempts. Where possible, use a PDF sanitization/rewriting step (e.g., re-render to a clean PDF or convert to a safer intermediate format) before documents reach the vulnerable renderer.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution DoS Inference AML.T0010.001 - AI Software AML.T0011 - User Execution

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.10 - Third-party and customer relationships

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-10118?

A crafted PDF can trigger an integer overflow in Poppler's Splash rendering backend (tilingPatternFill), causing an undersized heap allocation followed by an out-of-bounds write that can lead to code execution, information disclosure, or a crash in whatever process renders the file. This isn't an AI-specific flaw, but Poppler ships bundled inside Red Hat's AI Inference Server container images (vllm-cuda-rhel9, vllm-rocm-rhel9, vllm-spyre-rhel9, model-opt-cuda-rhel9), so any document-ingestion or PDF-processing step in those inference pipelines inherits the exposure — and the library carries a rough track record (74 other CVEs, 129 downstream dependents). Exploitation requires local access and user interaction (CVSS AV:L/UI:R), a public PoC already exists, and CISA's SSVC decision sits at TRACK rather than ACT/ATTEND, while the EPSS score (0.00252) is objectively low despite the 'top 83% percentile' framing — net-net this is a real but not urgent bug. Patch by updating Poppler to the fixed release referenced in the Red Hat advisories (RHSA-2026:24984/24985/25058/27720-27725/27727) across any affected container image, and until then avoid rendering untrusted PDFs through Poppler-based tooling anywhere in a document-ingestion pipeline feeding your AI stack.

Is CVE-2026-10118 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-10118, increasing the risk of exploitation.

How to fix CVE-2026-10118?

Update Poppler to the patched version referenced in the vendor advisories (RHSA-2026:24984, 24985, 25058, 27720-27725, 27727) and rebuild/repull any Red Hat AI Inference Server container images (rhaiis/vllm-cuda-rhel9, vllm-rocm-rhel9, vllm-spyre-rhel9, model-opt-cuda-rhel9) once fixed builds are available. Until patched, avoid rendering untrusted or user-supplied PDFs with Splash-based Poppler tooling in any document-ingestion or RAG-loading step; run PDF rendering in a sandboxed/unprivileged process or container with seccomp and no network egress to limit blast radius. As a detection signal, monitor for unexpected crashes, segfaults, or OOM events in PDF-processing worker processes, which can indicate failed or successful overflow attempts. Where possible, use a PDF sanitization/rewriting step (e.g., re-render to a clean PDF or convert to a safer intermediate format) before documents reach the vulnerable renderer.

What systems are affected by CVE-2026-10118?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, model serving, document ingestion pipelines.

What is the CVSS score for CVE-2026-10118?

CVE-2026-10118 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesmodel servingdocument ingestion pipelines

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011 User Execution

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

Exploitation Scenario

An attacker uploads a PDF crafted with a malformed tiling pattern to a system that ingests user- or partner-supplied documents into an AI pipeline — for example, a RAG document loader, an evidence-pack uploader, or a report-generation feature running on Red Hat AI Inference Server. When the ingestion pipeline (or an analyst manually) renders the file using Poppler's Splash backend to extract text or generate thumbnails, the tilingPatternFill integer overflow triggers, producing an undersized heap allocation. The attacker has shaped the subsequent out-of-bounds write to corrupt adjacent heap structures and hijack control flow, achieving code execution inside the rendering process/container — or, if the exploit isn't perfectly reliable, at minimum crashing the ingestion worker and disrupting the AI pipeline's document-processing capability.

Weaknesses (CWE)

CWE-190 Integer Overflow or Wraparound

CWE-190 — Integer Overflow or Wraparound: The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

[Requirements] Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. If possible, choose a language or compiler that performs automatic bounds checking.

Source: MITRE CWE corpus.