CVE-2017-14927 — poppler: NULL pointer dereference in the SplashOutputDev::type3D0() function

MEDIUM

poppler: NULL pointer dereference in the SplashOutputDev::type3D0() function

Published Sep 29, 2017

5.5

MEDIUM

CVSS 3.0

EPSS 0.90%

In Poppler 0.59.0, a NULL Pointer Dereference exists in the SplashOutputDev::type3D0() function in SplashOutputDev.cc via a crafted PDF document.

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	poppler	Will not fix	n/a
Red Hat Enterprise Linux 6	poppler	Will not fix	n/a
Red Hat Enterprise Linux 7	poppler	Will not fix	n/a

No remediation recorded yet.

0.90% 0.00904

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00904

2021–2026

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.90% (0.00904)	58.34th	v5 (v2026.06.15)
Aug 23, 2026	1.55% (0.01555)	72.83th	v5 (v2026.06.15)
Jul 20, 2024	0.08% (0.00078)	33.74th	v3 (v2023.03.01)
Jun 11, 2024	0.08% (0.00078)	33.27th	v3 (v2023.03.01)
Mar 7, 2023	0.06% (0.00055)	20.73th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00885)	10.50th	v2 (v2022.01.01)
Feb 3, 2022	0.42% (0.00416)	10.04th	v5 (v2026.06.15)
Apr 14, 2021	0.42% (0.00416)	0.00th	v1

Weaknesses (1)

CWE-476

NULL Pointer Dereference

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2017-14927		Vendor Advisory
https://bugs.freedesktop.org/show_bug.cgi?id=102604		x_refsource_CONFIRMIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1500324		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-14927
https://www.cve.org/CVERecord?id=CVE-2017-14927