Every CVE Search/ Get API key

CVE-2025-50422

An issue was discovered in freedesktop poppler v25.04.0. The heap memory containing PDF stream...

2.9 LowPublic exploitFix available

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.26%Up 0.2 points since Aug 5, 2025
90%50%10%1%

What each source reports

CVE List Score used 2.9

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.

Record
CVE-2025-50422
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-617
Updated
2026-11-02
EUVDEUVD-2025-23528 2.9

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.

Record
EUVD-2025-23528
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-6f98-2v97-grfv 6.5

An issue was discovered in freedesktop poppler v25.04.0. The heap memory containing PDF stream...

An issue was discovered in freedesktop poppler v25.04.0. The heap memory containing PDF stream objects is not cleared upon program exit, allowing attackers to obtain sensitive PDF content via a memory dump.

Record
GHSA-6f98-2v97-grfv
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-244, CWE-617
Updated
2026-11-02
NVD 2.9

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.

Record
CVE-2025-50422
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-617
Updated
2026-11-02
OSV 2.9

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.

Record
CVE-2025-50422
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-617
Updated
2026-11-04
OSVDEBIAN-CVE-2025-50422 2.9

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.

Record
DEBIAN-CVE-2025-50422
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 18 moreShow less
OSVJLSEC-2026-1194 2.9

An issue was discovered in freedesktop poppler v25.04.0. The heap memory containing PDF stream...

An issue was discovered in freedesktop poppler v25.04.0. The heap memory containing PDF stream objects is not cleared upon program exit, allowing attackers to obtain sensitive PDF content via a memory dump.

Record
JLSEC-2026-1194
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-2732 2.9

cairo security update

Cairo is a 2D graphics libarary with support for multiple output devices. It provides high-quality display and print output and this package also contains functionality to make cairo graphics library integrate well with GObject used by GNOME.

Security Fix(es):

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.(CVE-2025-50422)

Record
OESA-2025-2732
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-2733 2.9

cairo security update

Cairo is a 2D graphics libarary with support for multiple output devices. It provides high-quality display and print output and this package also contains functionality to make cairo graphics library integrate well with GObject used by GNOME.

Security Fix(es):

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.(CVE-2025-50422)

Record
OESA-2025-2733
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-2734 2.9

cairo security update

Cairo is a 2D graphics libarary with support for multiple output devices. It provides high-quality display and print output and this package also contains functionality to make cairo graphics library integrate well with GObject used by GNOME.

Security Fix(es):

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.(CVE-2025-50422)

Record
OESA-2025-2734
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2025-50422 5.5

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.

Record
UBUNTU-CVE-2025-50422
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-66159 No score

CVE-2025-50422 affecting package cairo 1.18.0-1

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.

Record
AZL-66159
Updated
2026-11-05
OSVAZL-67719 No score

CVE-2025-50422 affecting package cairo 1.17.4-3

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.

Record
AZL-67719
Updated
2026-11-02
OSVopenSUSE-SU-2025:15457-1 No score

cairo-devel-1.18.4-3.1 on GA media

These are all security issues fixed in the cairo-devel-1.18.4-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15457-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20697-1 No score

Security update for cairo

This update for cairo fixes the following issue:

  • CVE-2025-50422: Poppler crash on malformed input (bsc#1247589).
Record
openSUSE-SU-2026:20697-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2025-50422 No score

CVE-2025-50422 in cairo - Patched by Root

Root has patched CVE-2025-50422 in the cairo package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2025-50422
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2025-50422 No score

CVE-2025-50422 in cairo - Patched by Root

Root has patched CVE-2025-50422 in the cairo package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2025-50422
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2025-50422 No score

CVE-2025-50422 in cairo - Patched by Root

Root has patched CVE-2025-50422 in the cairo package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2025-50422
Updated
2026-11-02
OSVSUSE-SU-2025:02843-1 No score

Security update for cairo

This update for cairo fixes the following issues:

  • CVE-2025-50422: NULL pointer access in active_edges_to_traps() can lead to crash in Poppler (bsc#1247589).
Record
SUSE-SU-2025:02843-1
Updated
2026-11-02
OSVSUSE-SU-2025:03280-1 No score

Security update for cairo

This update for cairo fixes the following issues:

  • CVE-2025-50422: NULL pointer access in active_edges_to_traps() can lead to crash in Poppler (bsc#1247589).
Record
SUSE-SU-2025:03280-1
Updated
2026-11-02
OSVSUSE-SU-2025:03449-1 No score

Security update for cairo

This update for cairo fixes the following issues:

  • CVE-2025-50422: Fixed Poppler crash on malformed input (bsc#1247589)

  • Update to version 1.18.4:

    • The dependency on LZO has been made optional through a build time configuration toggle.
    • You can build Cairo against a Freetype installation that does not have the FT_Color type.
    • Cairo tests now build on Solaris 11.4 with GCC 14.
    • The DirectWrite backend now builds on MINGW 11.
    • The DirectWrite backend now supports font variations and proper glyph coverage.

  • Use tarball in lieu of source service due to freedesktop gitlab migration, will switch back at next release at the latest.

  • Add pkgconfig(lzo2) BuildRequires: New optional dependency, build lzo2 support feature.

  • Convert to source service: allows for easier upgrades by the GNOME team.

  • Update to version 1.18.2:

    • The malloc-stats code has been removed from the tests directory
    • Cairo now requires a version of pixman equal to, or newer than, 0.40.
    • There have been multiple build fixes for newer versions of GCC for MSVC; for Solaris; and on macOS 10.7.
    • PNG errors caused by loading malformed data are correctly propagated to callers, so they can handle the case.
    • Both stroke and fill colors are now set when showing glyphs on a PDF surface.
    • All the font options are copied when creating a fallback font object.
    • When drawing text on macOS, Cairo now tries harder to select the appropriate font name.
    • Cairo now prefers the COLRv1 table inside a font, if one is available.
    • Cairo requires a C11 toolchain when building.
Record
SUSE-SU-2025:03449-1
Updated
2026-11-02
OSVSUSE-SU-2025:03450-1 No score

Security update for cairo

This update for cairo fixes the following issues:

  • CVE-2019-6461: Avoid assert when drawing arcs with NaN angles. (bsc#1122338)
  • CVE-2025-50422: Fix NULL pointer access in active_edges_to_traps() leading to crash in Poppler. (bsc#1247589)
Record
SUSE-SU-2025:03450-1
Updated
2026-11-02
OSVSUSE-SU-2026:21573-1 No score

Security update for cairo

This update for cairo fixes the following issue:

  • CVE-2025-50422: Poppler crash on malformed input (bsc#1247589).
Record
SUSE-SU-2026:21573-1
Updated
2026-11-02
OSVSUSE-SU-2026:21583-1 No score

Security update for cairo

This update for cairo fixes the following issue:

  • CVE-2025-50422: Poppler crash on malformed input (bsc#1247589).
Record
SUSE-SU-2026:21583-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cairo
Azure Linux:3
 through 1.18.0-1 None known
cairo
Azure Linux:2
 through 1.17.4-3 None known
cairo
Debian:12
 All versions, plus listed versions
1.16.0-71.17.8-11.17.8-21.17.8-31.18.0-1
Show 8 moreShow less
1.18.0-1~hurd.11.18.0-21.18.0-31.18.2-11.18.2-21.18.4-11.18.4-21.18.4-3
 None known
cairo
Debian:13
 All versions, plus listed versions
1.18.4-11.18.4-21.18.4-3
 None known
cairo
Debian:14
 All versions, plus listed versions
1.18.4-11.18.4-21.18.4-3
 None known
Cairo_NoGPL_jll
Julia
 All versions None known
Cairo_jll
Julia
 All versions None known
cairo
openEuler:24.03-LTS-SP1
 before 1.18.0-2.oe2403sp1
1.18.0-2.oe2403sp1
cairo
openEuler:24.03-LTS-SP2
 before 1.18.0-2.oe2403sp2
1.18.0-2.oe2403sp2
cairo
openEuler:24.03-LTS
 before 1.18.0-2.oe2403
1.18.0-2.oe2403
Show 25 moreShow less
Affected packages
PackageAffectedFixed
cairo
Root:Debian:11
 before 1.16.0-5.aikido.2
1.16.0-5.aikido.21.16.0-5.root.io.1
rootio-cairo
Root:Debian:11
 before 1.16.0-5.aikido.2
1.16.0-5.aikido.21.16.0-5.root.io.1
cairo
Root:Debian:12
 before 1.16.0-7.root.io.3
1.16.0-7.root.io.31.16.0-7.root.io.11.16.0-7.root.io.21.16.0-7.root.io.41.16.0-7.aikido.5
rootio-cairo
Root:Debian:12
 before 1.16.0-7.root.io.3
1.16.0-7.root.io.31.16.0-7.root.io.11.16.0-7.root.io.21.16.0-7.root.io.41.16.0-7.aikido.5
cairo
Root:Debian:13
 before 1.18.4-1.root.io.1
1.18.4-1.root.io.11.18.4-1.root.io.21.18.4-1.root.io.31.18.4-1.root.io.41.18.4-1.aikido.51.18.4-1.aikido.6
rootio-cairo
Root:Debian:13
 before 1.18.4-1.root.io.1
1.18.4-1.root.io.11.18.4-1.root.io.21.18.4-1.root.io.31.18.4-1.root.io.41.18.4-1.aikido.51.18.4-1.aikido.6
cairo
SUSE:Linux Enterprise Micro 5.2
 before 1.16.0-150200.5.8.1
1.16.0-150200.5.8.1
cairo
SUSE:Linux Enterprise Micro 5.3
 before 1.16.0-150400.11.9.1
1.16.0-150400.11.9.1
cairo
SUSE:Linux Enterprise Micro 5.4
 before 1.16.0-150400.11.9.1
1.16.0-150400.11.9.1
cairo
SUSE:Linux Enterprise Micro 5.5
 before 1.16.0-150400.11.9.1
1.16.0-150400.11.9.1
cairo
SUSE:Linux Enterprise Module for Basesystem 15 SP6
 before 1.18.4-150600.3.3.1
1.18.4-150600.3.3.1
cairo
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.18.4-150600.3.3.1
1.18.4-150600.3.3.1
cairo
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
 before 1.18.4-150600.3.3.1
1.18.4-150600.3.3.1
cairo
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
 before 1.18.4-150600.3.3.1
1.18.4-150600.3.3.1
cairo
openSUSE:Leap 15.6
 before 1.18.4-150600.3.3.1
1.18.4-150600.3.3.1
cairo
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 2 CVEs
 before 1.15.2-25.11.1
1.15.2-25.11.1
cairo
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.14.2-2ubuntu21.14.4-11.14.6-11.14.6-1ubuntu0.1~esm11.14.6-1ubuntu0.1~esm2
 None known
cairo
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.14.10-1ubuntu11.15.8-21.15.8-31.15.10-21.15.10-2ubuntu0.11.15.10-2ubuntu0.1+esm1
 None known
cairo
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.16.0-41.16.0-4ubuntu11.16.0-4ubuntu1+esm1
 None known
cairo
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.16.0-5ubuntu11.16.0-5ubuntu21.16.0-5ubuntu2.1
 None known
cairo
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.18.0-11.18.0-1ubuntu11.18.0-31.18.0-3build1
 None known
cairo
Ubuntu:25.10
 All versions, plus listed versions
1.18.4-11.18.4-1build1
 None known
cairo
Ubuntu:26.10
 All versions, plus listed versions
1.18.4-3
 None known
cairo
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.18.4-1build11.18.4-3
 None known
cairo
openSUSE:Tumbleweed
 before 1.18.4-3.1
1.18.4-3.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubLandw-hub/CVE-2025-504222025-08-01

History

History
RecordedChangedSources
affectedOSV
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-50422 is a low vulnerability (CVSS 2.9) in Cairographics Cairo, published August 4, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in cairo 1.18.0-2.oe2403sp1.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open