CVE-2025-32365

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.

is a PDF rendering library.

Security Fix(es):

A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.(CVE-2025-32364)

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.(CVE-2025-32365)

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

Security Fix(es):

• poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

Security Fix(es):

• poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

Security Fix(es):

• poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

Security Fix(es):

• poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

Security Fix(es):

• poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

Security Fix(es):

• poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2025-32365: prevent out-of-bounds reads in JBIG2Bitmap::combine function in JBIG2Stream.cc

• CVE-2025-32365: fix segmentation fault due to an invalid memory read, occurring in JBIG2Bitmap::combine

• CVE-2025-32365: prevent out-of-bounds reads in JBIG2Bitmap::combine function in JBIG2Stream.cc

• SECURITY UPDATE: out-of-bounds read in JBIG2Bitmap::combine() (JBIG2Stream.cc) via a crafted JBIG2 stream, from a misplaced isOk check
  • debian/patches/CVE-2025-32365.patch: add the isOk() guard at the top of JBIG2Bitmap::combine() so every caller is protected against out-of-bounds reads on a not-OK bitmap (upstream commit 1f151565, adapted to poppler 0.62 GBool/Guint)
  • CVE-2025-32365
• SECURITY UPDATE: uncontrolled recursion / stack overflow in the XRefStm chain parser (XRef.cc) via a crafted PDF, causing denial of service
  • debian/patches/CVE-2020-23804.patch: cap the XRefStm chain at 4096 entries in XRef::readXRefTable() to stop the readXRef/readXRefTable recursion from exhausting the stack on crafted PDFs (upstream commit ec8a43c8)
  • CVE-2020-23804

A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN. (CVE-2025-32364) Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check. (CVE-2025-32365)

These are all security issues fixed in the libpoppler-cpp2-25.04.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for poppler fixes the following issues:

• CVE-2025-32364: integer overflow due to INT_MIN negation in the PSStack::roll function of Function.cc leads to floating point exception crash in pdftotext (bsc#1240880).
• CVE-2025-32365: misplaced isOk check in the JBIG2Bitmap::combine function of JBIG2Stream.cc leads to out-of-bounds read (bsc#1240881).

This update for poppler fixes the following issues:

• CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
• CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)

This update for poppler fixes the following issues:

• CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
• CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)

This update for poppler fixes the following issues:

• CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
• CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)

This update for poppler fixes the following issues:

• CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
• CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)
• Adding -fpie compile flag to GCC for Position Independent Executable (PIE) support (bsc#1239939).

It was discovered that poppler incorrectly handled memory when opening certain PDF files. An attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service.

USN-7426-1 fixed several vulnerabilities in poppler. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that poppler incorrectly handled memory when opening certain PDF files. An attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service.