CVE-2026-10118 is an important heap-based memory corruption vulnerability in the Poppler Splash backend. It arises from an integer overflow in the tilingPatternFill function when processing maliciously crafted PDF files. This overflow results in an undersized heap memory allocation, enabling an out-of-bounds write that can lead to arbitrary code execution, information disclosure, or denial of service. The vulnerability affects Poppler RPM packages included in Red Hat Hardened Images for aarch64 and x86_64 architectures. Exploitation requires supplying a malicious PDF to an application using Poppler for rendering. Red Hat has released updated Poppler RPMs (version 26.06.0-0.1.hum1) to fix this issue.

Exploitation of this vulnerability can lead to arbitrary code execution, allowing an attacker to run code within the context of the vulnerable application. It can also cause information disclosure or denial of service due to memory corruption. The attacker must be able to provide a crafted PDF file to the target application. The impact is high due to the potential for code execution and data compromise.

A security update fixing this vulnerability is available from Red Hat. Users should apply the updated Poppler RPM packages (version 26.06.0-0.1.hum1) included in the Red Hat Hardened Images security advisory RHSA-2026:30134. Until patched, users should avoid opening untrusted or suspicious PDF documents with applications that utilize the Poppler library for rendering to reduce the risk of exploitation.