Log in Start free

Vulnerability · Published Jul 2, 2025 · Assigned by GitHub_M

CVE-2025-52886Poppler Use After Free Vulnerability

Medium 5.5

In plain English

A medium-severity use-after-free in poppler from poppler. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.5Medium
Exploit odds (30 days)0.4%top 61.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12poppler22.12.0-2+deb12u3DEBIAN-CVE-2025-52886
Debian:13poppler25.03.0-5DEBIAN-CVE-2025-52886
Debian:14poppler25.03.0-5DEBIAN-CVE-2025-52886
Ubuntu:22.04:LTSpoppler22.02.0-2ubuntu0.9USN-7675-1
Ubuntu:22.04:LTSpoppler22.02.0-2ubuntu0.9UBUNTU-CVE-2025-52886
Ubuntu:24.04:LTSpoppler24.02.0-1ubuntu9.5USN-7675-1
Ubuntu:24.04:LTSpoppler24.02.0-1ubuntu9.5UBUNTU-CVE-2025-52886

Affected products (as reported)

VendorProductVersions
poppler poppler < 25.06.0

Weakness: CWE-416 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References