CVE-2025-32364
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an...
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
CVE-2025-32364- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2025-9922
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
EUVD-2025-9922- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-69gq-2xc5-f33j
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an...
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
GHSA-69gq-2xc5-f33j- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
CVE-2025-32364- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVBELL-CVE-2025-32364
- Record
BELL-CVE-2025-32364- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
CVE-2025-32364- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-190
- Updated
- 2026-11-02
Show 14 moreShow less
OSVDEBIAN-CVE-2025-32364
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
DEBIAN-CVE-2025-32364- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-85
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an...
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
JLSEC-2026-85- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1390
poppler security update
is a PDF rendering library.
Security Fix(es):
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.(CVE-2025-32364)
Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.(CVE-2025-32365)
- Record
OESA-2025-1390- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-32364
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
UBUNTU-CVE-2025-32364- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1776760883 No score
poppler: Fix of CVE-2025-32364
- CVE-2025-32364: fix floating-point exception in PSStack::roll when handling malformed PostScript input with INT_MIN
- Record
CLSA-2026-1776760883- Updated
- 2026-11-02
OSVMGASA-2025-0134 No score
Updated poppler packages fix security vulnerabilities
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN. (CVE-2025-32364) Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check. (CVE-2025-32365)
- Record
MGASA-2025-0134- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14976-1 No score
libpoppler-cpp2-25.04.0-1.1 on GA media
These are all security issues fixed in the libpoppler-cpp2-25.04.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14976-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01780-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2025-32364: integer overflow due to INT_MIN negation in the PSStack::roll function of Function.cc leads to floating point exception crash in pdftotext (bsc#1240880).
- CVE-2025-32365: misplaced isOk check in the JBIG2Bitmap::combine function of JBIG2Stream.cc leads to out-of-bounds read (bsc#1240881).
- Record
SUSE-SU-2025:01780-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1172-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
- CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)
- Record
SUSE-SU-2025:1172-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1173-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
- CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)
- Record
SUSE-SU-2025:1173-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1339-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
- CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)
- Record
SUSE-SU-2025:1339-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1342-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
- CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)
- Adding -fpie compile flag to GCC for Position Independent Executable (PIE) support (bsc#1239939).
- Record
SUSE-SU-2025:1342-1- Updated
- 2026-11-02
OSVUSN-7426-1 No score
poppler vulnerabilities
It was discovered that poppler incorrectly handled memory when opening certain PDF files. An attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service.
- Record
USN-7426-1- Updated
- 2026-11-02
OSVUSN-7426-2 No score
poppler vulnerabilities
USN-7426-1 fixed several vulnerabilities in poppler. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that poppler incorrectly handled memory when opening certain PDF files. An attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service.
- Record
USN-7426-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerAlpaquita:stream |
23.03.0-r1 up to 25.04.0-r0 | 25.04.0-r0 |
popplerTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-cppTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-cpp-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-glibTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-glib-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-glib-docTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-qt5TuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-qt5-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
poppler-utilsTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
popplerDebian:12 |
before 22.12.0-2+deb12u1, plus listed versions 22.12.0-2 |
22.12.0-2+deb12u1 |
popplerDebian:13 |
before 25.03.0-3 | 25.03.0-3 |
popplerDebian:14 |
before 25.03.0-3 | 25.03.0-3 |
popplerDebian:11 From an advisory covering 9 CVEs |
before 20.09.0-3.1+deb11u2, plus listed versions 20.09.0-3.120.09.0-3.1+deb11u1 |
20.09.0-3.1+deb11u2 |
Poppler_jllJulia |
before 25.10.0+0 | 25.10.0+0 |
popplerMageia:9 From an advisory covering 2 CVEs |
before 23.02.0-1.5.mga9 | 23.02.0-1.5.mga9 |
poppleropenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 0.90.0-11.oe2003sp4 | 0.90.0-11.oe2003sp4 |
poppleropenEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs |
before 0.90.0-11.oe2203sp3 | 0.90.0-11.oe2203sp3 |
poppleropenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 0.90.0-11.oe2203sp4 | 0.90.0-11.oe2203sp4 |
poppleropenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 23.12.0-6.oe2403sp1 | 23.12.0-6.oe2403sp1 |
poppleropenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 23.12.0-6.oe2403sp1 | 23.12.0-6.oe2403sp1 |
popplerSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 2 CVEs |
before 0.43.0-16.55.1 | 0.43.0-16.55.1 |
poppler-qtSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 2 CVEs |
before 0.43.0-16.55.1 | 0.43.0-16.55.1 |
popplerSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 2 CVEs |
before 0.79.0-150200.3.38.1 | 0.79.0-150200.3.38.1 |
popplerSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 2 CVEs |
before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
popplerSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 2 CVEs |
before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
poppler-qt5SUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 2 CVEs |
before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
poppler-qt6SUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 2 CVEs |
before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
poppleropenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
poppler-qt5openSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
poppler-qt6openSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
popplerUbuntu:Pro:16.04:LTS |
before 0.41.0-0ubuntu1.16+esm6, plus listed versions 0.33.0-0ubuntu30.37.0-0ubuntu10.38.0-0ubuntu10.41.0-0ubuntu10.41.0-0ubuntu1.1 Show 20 moreShow less0.41.0-0ubuntu1.20.41.0-0ubuntu1.30.41.0-0ubuntu1.40.41.0-0ubuntu1.50.41.0-0ubuntu1.60.41.0-0ubuntu1.70.41.0-0ubuntu1.80.41.0-0ubuntu1.90.41.0-0ubuntu1.100.41.0-0ubuntu1.110.41.0-0ubuntu1.120.41.0-0ubuntu1.130.41.0-0ubuntu1.140.41.0-0ubuntu1.150.41.0-0ubuntu1.160.41.0-0ubuntu1.16+esm10.41.0-0ubuntu1.16+esm20.41.0-0ubuntu1.16+esm30.41.0-0ubuntu1.16+esm40.41.0-0ubuntu1.16+esm5 |
0.41.0-0ubuntu1.16+esm6 |
popplerUbuntu:Pro:18.04:LTS |
before 0.62.0-2ubuntu2.14+esm5, plus listed versions 0.57.0-2ubuntu40.57.0-2ubuntu50.62.0-1ubuntu10.62.0-2ubuntu10.62.0-2ubuntu2 Show 17 moreShow less0.62.0-2ubuntu2.10.62.0-2ubuntu2.20.62.0-2ubuntu2.40.62.0-2ubuntu2.50.62.0-2ubuntu2.60.62.0-2ubuntu2.70.62.0-2ubuntu2.80.62.0-2ubuntu2.90.62.0-2ubuntu2.100.62.0-2ubuntu2.110.62.0-2ubuntu2.120.62.0-2ubuntu2.130.62.0-2ubuntu2.140.62.0-2ubuntu2.14+esm10.62.0-2ubuntu2.14+esm20.62.0-2ubuntu2.14+esm30.62.0-2ubuntu2.14+esm4 |
0.62.0-2ubuntu2.14+esm5 |
popplerUbuntu:20.04:LTS |
before 0.86.1-0ubuntu1.6, plus listed versions 0.80.0-0ubuntu10.80.0-0ubuntu30.80.0-0ubuntu40.80.0-0ubuntu50.85.0-1ubuntu1 Show 7 moreShow less0.85.0-1ubuntu30.86.1-0ubuntu10.86.1-0ubuntu1.10.86.1-0ubuntu1.20.86.1-0ubuntu1.30.86.1-0ubuntu1.40.86.1-0ubuntu1.5 |
0.86.1-0ubuntu1.6 |
popplerUbuntu:22.04:LTS |
before 22.02.0-2ubuntu0.7, plus listed versions 21.06.1-121.11.0-1~ubuntu222.02.0-222.02.0-2ubuntu0.122.02.0-2ubuntu0.2 Show 4 moreShow less22.02.0-2ubuntu0.322.02.0-2ubuntu0.422.02.0-2ubuntu0.522.02.0-2ubuntu0.6 |
22.02.0-2ubuntu0.7 |
popplerUbuntu:24.04:LTS |
before 24.02.0-1ubuntu9.3, plus listed versions 23.08.0-2ubuntu123.12.0-1ubuntu224.02.0-1ubuntu224.02.0-1ubuntu824.02.0-1ubuntu924.02.0-1ubuntu9.124.02.0-1ubuntu9.2 |
24.02.0-1ubuntu9.3 |
popplerUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 0.86.1-0ubuntu1.6, plus listed versions 0.80.0-0ubuntu10.80.0-0ubuntu30.80.0-0ubuntu40.80.0-0ubuntu50.85.0-1ubuntu1 Show 7 moreShow less0.85.0-1ubuntu30.86.1-0ubuntu10.86.1-0ubuntu1.10.86.1-0ubuntu1.20.86.1-0ubuntu1.30.86.1-0ubuntu1.40.86.1-0ubuntu1.5 |
0.86.1-0ubuntu1.6 |
popplerUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 22.02.0-2ubuntu0.7, plus listed versions 21.06.1-121.11.0-1~ubuntu222.02.0-222.02.0-2ubuntu0.122.02.0-2ubuntu0.2 Show 4 moreShow less22.02.0-2ubuntu0.322.02.0-2ubuntu0.422.02.0-2ubuntu0.522.02.0-2ubuntu0.6 |
22.02.0-2ubuntu0.7 |
popplerUbuntu:24.04:LTS From an advisory covering 2 CVEs |
before 24.02.0-1ubuntu9.3, plus listed versions 23.08.0-2ubuntu123.12.0-1ubuntu224.02.0-1ubuntu224.02.0-1ubuntu824.02.0-1ubuntu924.02.0-1ubuntu9.124.02.0-1ubuntu9.2 |
24.02.0-1ubuntu9.3 |
popplerUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 0.41.0-0ubuntu1.16+esm6, plus listed versions 0.33.0-0ubuntu30.37.0-0ubuntu10.38.0-0ubuntu10.41.0-0ubuntu10.41.0-0ubuntu1.1 Show 20 moreShow less0.41.0-0ubuntu1.20.41.0-0ubuntu1.30.41.0-0ubuntu1.40.41.0-0ubuntu1.50.41.0-0ubuntu1.60.41.0-0ubuntu1.70.41.0-0ubuntu1.80.41.0-0ubuntu1.90.41.0-0ubuntu1.100.41.0-0ubuntu1.110.41.0-0ubuntu1.120.41.0-0ubuntu1.130.41.0-0ubuntu1.140.41.0-0ubuntu1.150.41.0-0ubuntu1.160.41.0-0ubuntu1.16+esm10.41.0-0ubuntu1.16+esm20.41.0-0ubuntu1.16+esm30.41.0-0ubuntu1.16+esm40.41.0-0ubuntu1.16+esm5 |
0.41.0-0ubuntu1.16+esm6 |
popplerUbuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 0.62.0-2ubuntu2.14+esm5, plus listed versions 0.57.0-2ubuntu40.57.0-2ubuntu50.62.0-1ubuntu10.62.0-2ubuntu10.62.0-2ubuntu2 Show 17 moreShow less0.62.0-2ubuntu2.10.62.0-2ubuntu2.20.62.0-2ubuntu2.40.62.0-2ubuntu2.50.62.0-2ubuntu2.60.62.0-2ubuntu2.70.62.0-2ubuntu2.80.62.0-2ubuntu2.90.62.0-2ubuntu2.100.62.0-2ubuntu2.110.62.0-2ubuntu2.120.62.0-2ubuntu2.130.62.0-2ubuntu2.140.62.0-2ubuntu2.14+esm10.62.0-2ubuntu2.14+esm20.62.0-2ubuntu2.14+esm30.62.0-2ubuntu2.14+esm4 |
0.62.0-2ubuntu2.14+esm5 |
poppleropenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 25.04.0-1.1 | 25.04.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-32364 is a medium vulnerability (CVSS 4.0) in Freedesktop Poppler, published April 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in poppler 25.04.0-r0.
References
gitlab.freedesktop.org/poppler/poppler/-/issues/1574
lists.debian.org/debian-lts-announce/2025/04/msg00037.html
nvd.nist.gov/vuln/detail/CVE-2025-32364
github.com/advisories/GHSA-69gq-2xc5-f33j
docs.bell-sw.com/security/cves/CVE-2025-32364
Show 24 moreShow less
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1776760883.html
security-tracker.debian.org/tracker/CVE-2025-32364
advisories.mageia.org/MGASA-2025-0134.html
bugs.mageia.org/show_bug.cgi?id=34182
ubuntu.com/security/notices/USN-7426-1
lists.opensuse.org/archives/list/[email protected]/message/7MHRTVNCUQHLCEUDCYX24NK4ID3BMFG5
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1390
suse.com/support/update/announcement/2025/suse-su-202501780-1
bugzilla.suse.com/1240880
cve.org/CVERecord?id=CVE-2025-32364