CVE-2026-10118 affects the Poppler library's Splash backend by triggering an integer overflow in the tilingPatternFill function when rendering a malicious PDF. This overflow causes an undersized heap allocation followed by an out-of-bounds write, resulting in heap-based memory corruption. Successful exploitation can lead to arbitrary code execution, information disclosure, or denial of service within the context of the vulnerable application. The vulnerability requires an attacker to supply or trick a user into processing a crafted PDF file. Red Hat AI Inference Server 3.3.5 (ROCm) includes this vulnerable component. No official fix has been released yet, and Red Hat recommends avoiding untrusted PDF files as a mitigation.

The vulnerability can allow an attacker to execute arbitrary code, disclose sensitive information, or cause denial of service in applications using the Poppler Splash backend for PDF rendering. This can compromise the confidentiality, integrity, and availability of the affected system within the scope of the application processing the malicious PDF. The attack vector requires local user interaction to open or process a crafted PDF file. The severity is critical due to the potential for full compromise of the application context.

Red Hat has not released a patch or official fix for this vulnerability at this time. Users should mitigate risk by avoiding opening untrusted or suspicious PDF documents with applications that utilize the Poppler library for rendering. Limiting exposure to untrusted PDF content reduces the likelihood of exploitation. Monitor Red Hat advisories for updates regarding patches or official remediation.