Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.
CVSS Details
- CVSS 4.0 Base Score: 5.5 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade poppler | Jul 4, 2025 | Jul 2, 2025 |
| Gentoo Linux | — | Upgrade app-text/poppler. | Nov 25, 2025 | Sep 17, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 2, 2025 |
| Suse | — | Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-glib-develUpgrade libpoppler89Upgrade libpoppler-qt5-1Upgrade libpoppler-qt5-develUpgrade libpoppler-qt6-3Upgrade libpoppler-qt5-1-32bitUpgrade libpoppler-cpp2Upgrade libpoppler117Upgrade libpoppler-cpp0-32bitUpgrade libpoppler-qt4-4Upgrade libpoppler135Upgrade libpoppler-qt4-develUpgrade libpoppler-develUpgrade libpoppler126Upgrade libpoppler-glib8-32bitUpgrade libpoppler148Upgrade libpoppler-qt6-develUpgrade libpoppler60Upgrade libpoppler135-32bitUpgrade poppler-toolsUpgrade libpoppler-glib8Upgrade libpoppler-cpp0 | Dec 5, 2025 | Jul 15, 2025 |
| Ubuntu | — | Upgrade libpoppler97 (Ubuntu Pro)Upgrade libpoppler147Upgrade libpoppler118Upgrade libpoppler134Upgrade libpoppler58 (Ubuntu Pro)Upgrade poppler-utils (Ubuntu Pro)Upgrade poppler-utilsUpgrade libpoppler73 (Ubuntu Pro) | Jul 28, 2025 | Jul 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub