Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade poppler-utilsUpgrade poppler-develUpgrade poppler-cppUpgrade poppler-qt5Upgrade poppler-glib-docUpgrade poppler-qt5-develUpgrade poppler-glib-develUpgrade popplerUpgrade poppler-glibUpgrade poppler-cpp-devel | Jan 8, 2026 | Jan 6, 2026 |
| Debian | — | Upgrade poppler | Apr 29, 2025 | Apr 5, 2025 |
| Oracle_linux | — | Upgrade poppler-qt6Upgrade poppler-develUpgrade poppler-cppUpgrade popplerUpgrade poppler-cpp-develUpgrade poppler-qt5Upgrade poppler-glib-develUpgrade poppler-qt5-develUpgrade poppler-utilsUpgrade poppler-glibUpgrade poppler-qt6-develUpgrade poppler-glib-doc | Jan 9, 2026 | Apr 5, 2025 |
| Redhat_linux | — | Upgrade poppler-cpp-develUpgrade poppler-glibUpgrade poppler-debugsourceUpgrade poppler-glib-develUpgrade poppler-utils-debuginfoUpgrade popplerUpgrade poppler-debuginfoNo solution existsUpgrade poppler-glib-debuginfoUpgrade poppler-qt6-develUpgrade poppler-qt6-debuginfoUpgrade poppler-develUpgrade poppler-qt5-develUpgrade poppler-utilsUpgrade poppler-cpp-debuginfoUpgrade poppler-qt5-debuginfoUpgrade poppler-qt6Upgrade poppler-glib-docUpgrade poppler-cppUpgrade poppler-qt5 | Jul 9, 2025 | Apr 5, 2025 |
| Rocky_linux | — | Upgrade poppler-glib-debuginfoUpgrade poppler-glib-develUpgrade poppler-debugsourceUpgrade poppler-glibUpgrade popplerUpgrade poppler-utils-debuginfoUpgrade poppler-debuginfoUpgrade poppler-cpp-develUpgrade poppler-qt5-develUpgrade poppler-cppUpgrade poppler-qt5-debuginfoUpgrade poppler-qt5Upgrade poppler-utilsUpgrade poppler-cpp-debuginfoUpgrade poppler-devel | Jan 8, 2026 | Jan 7, 2026 |
| Suse | — | Upgrade libpoppler-qt5-develUpgrade libpoppler-cpp0-32bitUpgrade libpoppler148Upgrade libpoppler-qt4-4Upgrade poppler-toolsUpgrade libpoppler-cpp2Upgrade libpoppler-qt5-1Upgrade libpoppler-qt5-1-32bitUpgrade libpoppler-qt6-develUpgrade libpoppler135-32bitUpgrade libpoppler-glib-develUpgrade libpoppler60Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-cpp0Upgrade libpoppler-qt4-develUpgrade libpoppler89Upgrade libpoppler-qt6-3Upgrade libpoppler-develUpgrade libpoppler135Upgrade libpoppler-glib8-32bitUpgrade libpoppler-glib8 | Dec 5, 2025 | May 30, 2025 |
| Ubuntu | — | Upgrade libpoppler140Upgrade libpoppler73 (Ubuntu Pro)Upgrade libpoppler134Upgrade libpoppler97Upgrade poppler-utilsUpgrade poppler-utils (Ubuntu Pro)Upgrade libpoppler58 (Ubuntu Pro)Upgrade libpoppler118 | Apr 9, 2025 | Apr 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub