CVE-2024-56378
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the...
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
- Record
CVE-2024-56378- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2024-53136
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
- Record
EUVD-2024-53136- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h369-f67q-2q4c
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the...
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
- Record
GHSA-h369-f67q-2q4c- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
- Record
CVE-2024-56378- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVBELL-CVE-2024-56378
- Record
BELL-CVE-2024-56378- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
- Record
CVE-2024-56378- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 16 moreShow less
OSVDEBIAN-CVE-2024-56378
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
- Record
DEBIAN-CVE-2024-56378- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVJLSEC-2026-83
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
- Record
JLSEC-2026-83- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2024-2602
poppler security update
is a PDF rendering library.
Security Fix(es):
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.(CVE-2024-56378)
- Record
OESA-2024-2602- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-1018
poppler security update
is a PDF rendering library.
Security Fix(es):
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.(CVE-2024-56378)
- Record
OESA-2025-1018- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-56378
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
- Record
UBUNTU-CVE-2024-56378- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1787750503 No score
poppler: Fix of CVE-2024-56378
- CVE-2024-56378: prevent out-of-bounds read via signed integer overflow of the row index in JBIG2Bitmap::combine in JBIG2Stream.cc
- Record
CLSA-2026-1787750503- Updated
- 2026-11-02
OSVCLSA-2026-1788270342 No score
poppler: Fix of CVE-2024-56378
- fix CVE-2024-56378 signed row-coordinate overflow in JBIG2Bitmap::combine
- Record
CLSA-2026-1788270342- Updated
- 2026-11-02
OSVMGASA-2025-0022 No score
Updated poppler packages fix security vulnerability
libpoppler.so has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. (CVE-2024-56378)
- Record
MGASA-2025-0022- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14616-1 No score
libpoppler-cpp1-24.12.0-1.1 on GA media
These are all security issues fixed in the libpoppler-cpp1-24.12.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14616-1- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2024-56378 No score
CVE-2024-56378 in rootio-poppler - Patched by Root
Root has patched CVE-2024-56378 in the rootio-poppler package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2024-56378- Updated
- 2026-11-02
OSVSUSE-SU-2024:4421-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2024-56378: Fixed out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc (bsc#1234795)
- Record
SUSE-SU-2024:4421-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:4422-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2024-56378: out-of-bounds read within JBIG2Bitmap::combine, which can lead to an application crash. (bsc#1234795)
- Record
SUSE-SU-2024:4422-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:4423-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2024-56378: Fixed out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc (bsc#1234795)
- Record
SUSE-SU-2024:4423-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:4432-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2024-56378: Fixed out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc (bsc#1234795)
- Record
SUSE-SU-2024:4432-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:4435-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2024-56378: out-of-bounds read within JBIG2Bitmap::combine, which can lead to an application crash. (bsc#1234795)
- Record
SUSE-SU-2024:4435-1- Updated
- 2026-11-02
OSVUSN-7213-1 No score
poppler vulnerability
It was discovered that poppler incorrectly handled memory when opening certain PDF files. An attacker could possibly use this issue to cause denial of service or obtain sensitive information.
- Record
USN-7213-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerAlpaquita:23 |
22.11.0-r0 and later | None known |
popplerAlpaquita:stream |
23.03.0-r1 up to 25.01.0-r0 | 25.01.0-r0 |
popplerTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els8 | 21.01.0-21.el9.tuxcare.els8 |
poppler-cppTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els8 | 21.01.0-21.el9.tuxcare.els8 |
poppler-cpp-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els8 | 21.01.0-21.el9.tuxcare.els8 |
poppler-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els8 | 21.01.0-21.el9.tuxcare.els8 |
poppler-glibTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els8 | 21.01.0-21.el9.tuxcare.els8 |
poppler-glib-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els8 | 21.01.0-21.el9.tuxcare.els8 |
poppler-glib-docTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els8 | 21.01.0-21.el9.tuxcare.els8 |
poppler-qt5TuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els8 | 21.01.0-21.el9.tuxcare.els8 |
Show 43 moreShow less
| Package | Affected | Fixed |
|---|---|---|
poppler-qt5-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els8 | 21.01.0-21.el9.tuxcare.els8 |
poppler-utilsTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els8 | 21.01.0-21.el9.tuxcare.els8 |
popplerTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els8 | 21.01.0-14.el9_2.tuxcare.els8 |
poppler-cppTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els8 | 21.01.0-14.el9_2.tuxcare.els8 |
poppler-cpp-develTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els8 | 21.01.0-14.el9_2.tuxcare.els8 |
poppler-develTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els8 | 21.01.0-14.el9_2.tuxcare.els8 |
poppler-glibTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els8 | 21.01.0-14.el9_2.tuxcare.els8 |
poppler-glib-develTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els8 | 21.01.0-14.el9_2.tuxcare.els8 |
poppler-glib-docTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els8 | 21.01.0-14.el9_2.tuxcare.els8 |
poppler-qt5TuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els8 | 21.01.0-14.el9_2.tuxcare.els8 |
poppler-qt5-develTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els8 | 21.01.0-14.el9_2.tuxcare.els8 |
poppler-utilsTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els8 | 21.01.0-14.el9_2.tuxcare.els8 |
popplerDebian:12 |
before 22.12.0-2+deb12u1, plus listed versions 22.12.0-2 |
22.12.0-2+deb12u1 |
popplerDebian:13 |
before 24.08.0-4 | 24.08.0-4 |
popplerDebian:14 |
before 24.08.0-4 | 24.08.0-4 |
popplerDebian:11 From an advisory covering 9 CVEs |
before 20.09.0-3.1+deb11u2, plus listed versions 20.09.0-3.120.09.0-3.1+deb11u1 |
20.09.0-3.1+deb11u2 |
Poppler_jllJulia |
before 25.10.0+0 | 25.10.0+0 |
popplerMageia:9 |
before 23.02.0-1.4.mga9 | 23.02.0-1.4.mga9 |
poppleropenEuler:20.03-LTS-SP4 |
before 0.90.0-10.oe2003sp4 | 0.90.0-10.oe2003sp4 |
poppleropenEuler:22.03-LTS-SP1 |
before 0.90.0-10.oe2203sp1 | 0.90.0-10.oe2203sp1 |
poppleropenEuler:24.03-LTS |
before 23.12.0-4.oe2403 | 23.12.0-4.oe2403 |
poppleropenEuler:22.03-LTS-SP4 |
before 0.90.0-10.oe2203sp4 | 0.90.0-10.oe2203sp4 |
poppleropenEuler:22.03-LTS-SP3 |
before 0.90.0-10.oe2203sp3 | 0.90.0-10.oe2203sp3 |
poppleropenEuler:24.03-LTS-SP1 |
before 23.12.0-4.oe2403sp1 | 23.12.0-4.oe2403sp1 |
poppleropenSUSE:Leap 15.5 |
before 23.01.0-150500.3.14.1 | 23.01.0-150500.3.14.1 |
poppler-qt5openSUSE:Leap 15.5 |
before 23.01.0-150500.3.14.1 | 23.01.0-150500.3.14.1 |
poppler-qt6openSUSE:Leap 15.5 |
before 23.01.0-150500.3.14.1 | 23.01.0-150500.3.14.1 |
popplerSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 0.43.0-16.52.1 | 0.43.0-16.52.1 |
poppler-qtSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 0.43.0-16.52.1 | 0.43.0-16.52.1 |
popplerSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 0.79.0-150200.3.35.1 | 0.79.0-150200.3.35.1 |
popplerSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 24.03.0-150600.3.5.1 | 24.03.0-150600.3.5.1 |
popplerSUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 24.03.0-150600.3.5.1 | 24.03.0-150600.3.5.1 |
poppler-qt5SUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 24.03.0-150600.3.5.1 | 24.03.0-150600.3.5.1 |
poppler-qt6SUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 24.03.0-150600.3.5.1 | 24.03.0-150600.3.5.1 |
poppleropenSUSE:Leap 15.6 |
before 24.03.0-150600.3.5.1 | 24.03.0-150600.3.5.1 |
poppler-qt5openSUSE:Leap 15.6 |
before 24.03.0-150600.3.5.1 | 24.03.0-150600.3.5.1 |
poppler-qt6openSUSE:Leap 15.6 |
before 24.03.0-150600.3.5.1 | 24.03.0-150600.3.5.1 |
popplerUbuntu:Pro:16.04:LTS |
before 0.41.0-0ubuntu1.16+esm5, plus listed versions 0.33.0-0ubuntu30.37.0-0ubuntu10.38.0-0ubuntu10.41.0-0ubuntu10.41.0-0ubuntu1.1 Show 19 moreShow less0.41.0-0ubuntu1.20.41.0-0ubuntu1.30.41.0-0ubuntu1.40.41.0-0ubuntu1.50.41.0-0ubuntu1.60.41.0-0ubuntu1.70.41.0-0ubuntu1.80.41.0-0ubuntu1.90.41.0-0ubuntu1.100.41.0-0ubuntu1.110.41.0-0ubuntu1.120.41.0-0ubuntu1.130.41.0-0ubuntu1.140.41.0-0ubuntu1.150.41.0-0ubuntu1.160.41.0-0ubuntu1.16+esm10.41.0-0ubuntu1.16+esm20.41.0-0ubuntu1.16+esm30.41.0-0ubuntu1.16+esm4 |
0.41.0-0ubuntu1.16+esm5 |
popplerUbuntu:Pro:18.04:LTS |
before 0.62.0-2ubuntu2.14+esm4, plus listed versions 0.57.0-2ubuntu40.57.0-2ubuntu50.62.0-1ubuntu10.62.0-2ubuntu10.62.0-2ubuntu2 Show 16 moreShow less0.62.0-2ubuntu2.10.62.0-2ubuntu2.20.62.0-2ubuntu2.40.62.0-2ubuntu2.50.62.0-2ubuntu2.60.62.0-2ubuntu2.70.62.0-2ubuntu2.80.62.0-2ubuntu2.90.62.0-2ubuntu2.100.62.0-2ubuntu2.110.62.0-2ubuntu2.120.62.0-2ubuntu2.130.62.0-2ubuntu2.140.62.0-2ubuntu2.14+esm10.62.0-2ubuntu2.14+esm20.62.0-2ubuntu2.14+esm3 |
0.62.0-2ubuntu2.14+esm4 |
popplerUbuntu:20.04:LTS |
before 0.86.1-0ubuntu1.5, plus listed versions 0.80.0-0ubuntu10.80.0-0ubuntu30.80.0-0ubuntu40.80.0-0ubuntu50.85.0-1ubuntu1 Show 6 moreShow less0.85.0-1ubuntu30.86.1-0ubuntu10.86.1-0ubuntu1.10.86.1-0ubuntu1.20.86.1-0ubuntu1.30.86.1-0ubuntu1.4 |
0.86.1-0ubuntu1.5 |
popplerUbuntu:22.04:LTS |
before 22.02.0-2ubuntu0.6, plus listed versions 21.06.1-121.11.0-1~ubuntu222.02.0-222.02.0-2ubuntu0.122.02.0-2ubuntu0.222.02.0-2ubuntu0.322.02.0-2ubuntu0.422.02.0-2ubuntu0.5 |
22.02.0-2ubuntu0.6 |
popplerUbuntu:24.04:LTS |
before 24.02.0-1ubuntu9.2, plus listed versions 23.08.0-2ubuntu123.12.0-1ubuntu224.02.0-1ubuntu224.02.0-1ubuntu824.02.0-1ubuntu924.02.0-1ubuntu9.1 |
24.02.0-1ubuntu9.2 |
poppleropenSUSE:Tumbleweed |
before 24.12.0-1.1 | 24.12.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-56378 is a medium vulnerability (CVSS 4.3) in Freedesktop Poppler, published December 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 50th percentile. Fixed in poppler 25.01.0-r0.
References
gitlab.freedesktop.org/poppler/poppler/-/issues/1553
lists.debian.org/debian-lts-announce/2025/04/msg00037.html
nvd.nist.gov/vuln/detail/CVE-2024-56378
github.com/advisories/GHSA-h369-f67q-2q4c
Show 20 moreShow less
docs.bell-sw.com/security/cves/CVE-2024-56378
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787750503.html
security-tracker.debian.org/tracker/CVE-2024-56378
advisories.mageia.org/MGASA-2025-0022.html
bugs.mageia.org/show_bug.cgi?id=33932
ubuntu.com/security/notices/USN-7213-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2602
suse.com/support/update/announcement/2024/suse-su-20244421-1
bugzilla.suse.com/1234795
cve.org/CVERecord?id=CVE-2024-56378
lists.opensuse.org/archives/list/[email protected]/thread/EW5WCCC2WHA6TXCH4VTEHPKKPSJVIEDP