Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.
CVSS Details
- CVSS 4.0 Base Score: 5.5 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade poppler | Jul 4, 2025 | Jul 2, 2025 |
| Gentoo Linux | — | Upgrade app-text/poppler. | Nov 25, 2025 | Sep 17, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 2, 2025 |
| Suse | — | Upgrade libpoppler-cpp0Upgrade libpoppler126Upgrade libpoppler-glib8Upgrade libpoppler-glib8-32bitUpgrade libpoppler-qt6-develUpgrade libpoppler148Upgrade libpoppler60Upgrade libpoppler135-32bitUpgrade poppler-toolsUpgrade libpoppler-qt5-1-32bitUpgrade libpoppler-cpp0-32bitUpgrade libpoppler-develUpgrade libpoppler-cpp2Upgrade libpoppler-qt5-develUpgrade libpoppler-qt6-3Upgrade libpoppler-qt4-4Upgrade libpoppler-qt4-develUpgrade typelib-1_0-Poppler-0_18Upgrade libpoppler135Upgrade libpoppler89Upgrade libpoppler117Upgrade libpoppler-glib-develUpgrade libpoppler-qt5-1 | Dec 5, 2025 | Jul 15, 2025 |
| Ubuntu | — | Upgrade libpoppler73 (Ubuntu Pro)Upgrade poppler-utils (Ubuntu Pro)Upgrade libpoppler58 (Ubuntu Pro)Upgrade libpoppler134Upgrade libpoppler118Upgrade poppler-utilsUpgrade libpoppler147Upgrade libpoppler97 (Ubuntu Pro) | Jul 28, 2025 | Jul 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub