CVE-2009-3607: Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x...

Security readout for executives and security teams

CVE-2009-3607 is a Poppler 0.x PDF parsing flaw. A malicious PDF could corrupt memory when thumbnail data is processed, causing a crash and possibly arbitrary code execution. Business risk depends on whether legacy Poppler handles untrusted PDFs in user endpoints, mail gateways, document services, or web upload pipelines. Most likely exposure is legacy Poppler 0.x or distro packages using vulnerable Poppler code to render or inspect PDFs. Confirm through package inventories and applications that embed or link Poppler, especially services that process PDFs from users, email, or external partners. Treat as a legacy exposure cleanup item with high potential impact where untrusted PDFs are processed. It is not KEV-listed in the provided bundle, so prioritize based on actual Poppler use, internet-facing document workflows, and ability to patch quickly. Mitigation focus: Upgrade Poppler using relevant vendor or distribution advisories.; Prioritize systems that parse PDFs from untrusted sources.; Check Debian, Fedora, Ubuntu, Sun, and Mandriva guidance where applicable..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.