Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade poppler-develUpgrade poppler-cppUpgrade poppler-qt5-develUpgrade poppler-qt5Upgrade poppler-utilsUpgrade poppler-glib-docUpgrade popplerUpgrade poppler-glib-develUpgrade poppler-glibUpgrade poppler-cpp-devel | Jan 8, 2026 | Jan 6, 2026 |
| Debian | — | Upgrade poppler | Apr 29, 2025 | Apr 5, 2025 |
| Oracle_linux | — | Upgrade popplerUpgrade poppler-cppUpgrade poppler-develUpgrade poppler-qt6Upgrade poppler-glibUpgrade poppler-utilsUpgrade poppler-qt5Upgrade poppler-glib-develUpgrade poppler-qt6-develUpgrade poppler-cpp-develUpgrade poppler-qt5-develUpgrade poppler-glib-doc | Jan 9, 2026 | Apr 5, 2025 |
| Redhat_linux | — | Upgrade poppler-cpp-develUpgrade poppler-glib-develNo solution existsUpgrade poppler-debuginfoUpgrade poppler-glibUpgrade poppler-debugsourceUpgrade popplerUpgrade poppler-utils-debuginfoUpgrade poppler-qt6-debuginfoUpgrade poppler-cppUpgrade poppler-glib-debuginfoUpgrade poppler-cpp-debuginfoUpgrade poppler-qt5-develUpgrade poppler-develUpgrade poppler-qt6-develUpgrade poppler-glib-docUpgrade poppler-qt5Upgrade poppler-qt5-debuginfoUpgrade poppler-utilsUpgrade poppler-qt6 | Jul 9, 2025 | Apr 5, 2025 |
| Rocky_linux | — | Upgrade poppler-glibUpgrade popplerUpgrade poppler-debugsourceUpgrade poppler-glib-develUpgrade poppler-glib-debuginfoUpgrade poppler-qt5-develUpgrade poppler-qt5-debuginfoUpgrade poppler-cpp-develUpgrade poppler-develUpgrade poppler-debuginfoUpgrade poppler-cppUpgrade poppler-utils-debuginfoUpgrade poppler-cpp-debuginfoUpgrade poppler-utilsUpgrade poppler-qt5 | Jan 8, 2026 | Jan 7, 2026 |
| Suse | — | Upgrade libpoppler-cpp0-32bitUpgrade libpoppler-cpp2Upgrade libpoppler60Upgrade typelib-1_0-Poppler-0_18Upgrade poppler-toolsUpgrade libpoppler-cpp0Upgrade libpoppler-glib-develUpgrade libpoppler-qt4-4Upgrade libpoppler-qt5-1-32bitUpgrade libpoppler-qt6-develUpgrade libpoppler148Upgrade libpoppler-qt5-1Upgrade libpoppler-qt5-develUpgrade libpoppler135-32bitUpgrade libpoppler135Upgrade libpoppler-develUpgrade libpoppler-glib8-32bitUpgrade libpoppler89Upgrade libpoppler-qt6-3Upgrade libpoppler-qt4-develUpgrade libpoppler-glib8 | Dec 5, 2025 | May 30, 2025 |
| Ubuntu | — | Upgrade libpoppler58 (Ubuntu Pro)Upgrade libpoppler118Upgrade libpoppler140Upgrade libpoppler73 (Ubuntu Pro)Upgrade poppler-utils (Ubuntu Pro)Upgrade poppler-utilsUpgrade libpoppler134Upgrade libpoppler97 | Apr 9, 2025 | Apr 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub