CVE-2025-32364
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an...
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
CVE-2025-32364- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2025-9922
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
EUVD-2025-9922- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-69gq-2xc5-f33j
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an...
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
GHSA-69gq-2xc5-f33j- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
CVE-2025-32364- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVBELL-CVE-2025-32364
- Record
BELL-CVE-2025-32364- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
CVE-2025-32364- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-190
- Updated
- 2026-11-02
Show 14 moreShow less
OSVDEBIAN-CVE-2025-32364
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
DEBIAN-CVE-2025-32364- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-85
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an...
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
JLSEC-2026-85- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1390
poppler security update
is a PDF rendering library.
Security Fix(es):
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.(CVE-2025-32364)
Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.(CVE-2025-32365)
- Record
OESA-2025-1390- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-32364
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Record
UBUNTU-CVE-2025-32364- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1776760883No score
poppler: Fix of CVE-2025-32364
- CVE-2025-32364: fix floating-point exception in PSStack::roll when handling malformed PostScript input with INT_MIN
- Record
CLSA-2026-1776760883- Updated
- 2026-11-02
OSVMGASA-2025-0134No score
Updated poppler packages fix security vulnerabilities
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN. (CVE-2025-32364) Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check. (CVE-2025-32365)
- Record
MGASA-2025-0134- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14976-1No score
libpoppler-cpp2-25.04.0-1.1 on GA media
These are all security issues fixed in the libpoppler-cpp2-25.04.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14976-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01780-1No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2025-32364: integer overflow due to INT_MIN negation in the PSStack::roll function of Function.cc leads to floating point exception crash in pdftotext (bsc#1240880).
- CVE-2025-32365: misplaced isOk check in the JBIG2Bitmap::combine function of JBIG2Stream.cc leads to out-of-bounds read (bsc#1240881).
- Record
SUSE-SU-2025:01780-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1172-1No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
- CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)
- Record
SUSE-SU-2025:1172-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1173-1No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
- CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)
- Record
SUSE-SU-2025:1173-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1339-1No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
- CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)
- Record
SUSE-SU-2025:1339-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1342-1No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2025-32364: Fixed a floating point exception. (bsc#1240880)
- CVE-2025-32365: Fixed the isOk check in JBIG2Bitmap::combine function in JBIG2Stream.cc. (bsc#1240881)
- Adding -fpie compile flag to GCC for Position Independent Executable (PIE) support (bsc#1239939).
- Record
SUSE-SU-2025:1342-1- Updated
- 2026-11-02
OSVUSN-7426-1No score
poppler vulnerabilities
It was discovered that poppler incorrectly handled memory when opening certain PDF files. An attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service.
- Record
USN-7426-1- Updated
- 2026-11-02
OSVUSN-7426-2No score
poppler vulnerabilities
USN-7426-1 fixed several vulnerabilities in poppler. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that poppler incorrectly handled memory when opening certain PDF files. An attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service.
- Record
USN-7426-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerAlpaquita:stream | 23.03.0-r1 up to 25.04.0-r0 | 25.04.0-r0 |
popplerTuxCare:AlmaLinux:9.6 | before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-cppTuxCare:AlmaLinux:9.6 | before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-cpp-develTuxCare:AlmaLinux:9.6 | before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-develTuxCare:AlmaLinux:9.6 | before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-glibTuxCare:AlmaLinux:9.6 | before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-glib-develTuxCare:AlmaLinux:9.6 | before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-glib-docTuxCare:AlmaLinux:9.6 | before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-qt5TuxCare:AlmaLinux:9.6 | before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
poppler-qt5-develTuxCare:AlmaLinux:9.6 | before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
poppler-utilsTuxCare:AlmaLinux:9.6 | before 21.01.0-21.el9.tuxcare.els3 | 21.01.0-21.el9.tuxcare.els3 |
popplerDebian:12 | before 22.12.0-2+deb12u1, plus listed versions 22.12.0-2 | 22.12.0-2+deb12u1 |
popplerDebian:13 | before 25.03.0-3 | 25.03.0-3 |
popplerDebian:14 | before 25.03.0-3 | 25.03.0-3 |
popplerDebian:11 From an advisory covering 9 CVEs | before 20.09.0-3.1+deb11u2, plus listed versions 20.09.0-3.120.09.0-3.1+deb11u1 | 20.09.0-3.1+deb11u2 |
Poppler_jllJulia | before 25.10.0+0 | 25.10.0+0 |
popplerMageia:9 From an advisory covering 2 CVEs | before 23.02.0-1.5.mga9 | 23.02.0-1.5.mga9 |
poppleropenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs | before 0.90.0-11.oe2003sp4 | 0.90.0-11.oe2003sp4 |
poppleropenEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs | before 0.90.0-11.oe2203sp3 | 0.90.0-11.oe2203sp3 |
poppleropenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs | before 0.90.0-11.oe2203sp4 | 0.90.0-11.oe2203sp4 |
poppleropenEuler:24.03-LTS From an advisory covering 2 CVEs | before 23.12.0-6.oe2403sp1 | 23.12.0-6.oe2403sp1 |
poppleropenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs | before 23.12.0-6.oe2403sp1 | 23.12.0-6.oe2403sp1 |
popplerSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 2 CVEs | before 0.43.0-16.55.1 | 0.43.0-16.55.1 |
poppler-qtSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 2 CVEs | before 0.43.0-16.55.1 | 0.43.0-16.55.1 |
popplerSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 2 CVEs | before 0.79.0-150200.3.38.1 | 0.79.0-150200.3.38.1 |
popplerSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 2 CVEs | before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
popplerSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 2 CVEs | before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
poppler-qt5SUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 2 CVEs | before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
poppler-qt6SUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 2 CVEs | before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
poppleropenSUSE:Leap 15.6 From an advisory covering 2 CVEs | before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
poppler-qt5openSUSE:Leap 15.6 From an advisory covering 2 CVEs | before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
poppler-qt6openSUSE:Leap 15.6 From an advisory covering 2 CVEs | before 24.03.0-150600.3.10.1 | 24.03.0-150600.3.10.1 |
popplerUbuntu:Pro:16.04:LTS | before 0.41.0-0ubuntu1.16+esm6, plus listed versions 0.33.0-0ubuntu30.37.0-0ubuntu10.38.0-0ubuntu10.41.0-0ubuntu10.41.0-0ubuntu1.1 Show 20 moreShow less0.41.0-0ubuntu1.20.41.0-0ubuntu1.30.41.0-0ubuntu1.40.41.0-0ubuntu1.50.41.0-0ubuntu1.60.41.0-0ubuntu1.70.41.0-0ubuntu1.80.41.0-0ubuntu1.90.41.0-0ubuntu1.100.41.0-0ubuntu1.110.41.0-0ubuntu1.120.41.0-0ubuntu1.130.41.0-0ubuntu1.140.41.0-0ubuntu1.150.41.0-0ubuntu1.160.41.0-0ubuntu1.16+esm10.41.0-0ubuntu1.16+esm20.41.0-0ubuntu1.16+esm30.41.0-0ubuntu1.16+esm40.41.0-0ubuntu1.16+esm5 | 0.41.0-0ubuntu1.16+esm6 |
popplerUbuntu:Pro:18.04:LTS | before 0.62.0-2ubuntu2.14+esm5, plus listed versions 0.57.0-2ubuntu40.57.0-2ubuntu50.62.0-1ubuntu10.62.0-2ubuntu10.62.0-2ubuntu2 Show 17 moreShow less0.62.0-2ubuntu2.10.62.0-2ubuntu2.20.62.0-2ubuntu2.40.62.0-2ubuntu2.50.62.0-2ubuntu2.60.62.0-2ubuntu2.70.62.0-2ubuntu2.80.62.0-2ubuntu2.90.62.0-2ubuntu2.100.62.0-2ubuntu2.110.62.0-2ubuntu2.120.62.0-2ubuntu2.130.62.0-2ubuntu2.140.62.0-2ubuntu2.14+esm10.62.0-2ubuntu2.14+esm20.62.0-2ubuntu2.14+esm30.62.0-2ubuntu2.14+esm4 | 0.62.0-2ubuntu2.14+esm5 |
popplerUbuntu:20.04:LTS | before 0.86.1-0ubuntu1.6, plus listed versions 0.80.0-0ubuntu10.80.0-0ubuntu30.80.0-0ubuntu40.80.0-0ubuntu50.85.0-1ubuntu1 Show 7 moreShow less0.85.0-1ubuntu30.86.1-0ubuntu10.86.1-0ubuntu1.10.86.1-0ubuntu1.20.86.1-0ubuntu1.30.86.1-0ubuntu1.40.86.1-0ubuntu1.5 | 0.86.1-0ubuntu1.6 |
popplerUbuntu:22.04:LTS | before 22.02.0-2ubuntu0.7, plus listed versions 21.06.1-121.11.0-1~ubuntu222.02.0-222.02.0-2ubuntu0.122.02.0-2ubuntu0.2 Show 4 moreShow less22.02.0-2ubuntu0.322.02.0-2ubuntu0.422.02.0-2ubuntu0.522.02.0-2ubuntu0.6 | 22.02.0-2ubuntu0.7 |
popplerUbuntu:24.04:LTS | before 24.02.0-1ubuntu9.3, plus listed versions 23.08.0-2ubuntu123.12.0-1ubuntu224.02.0-1ubuntu224.02.0-1ubuntu824.02.0-1ubuntu924.02.0-1ubuntu9.124.02.0-1ubuntu9.2 | 24.02.0-1ubuntu9.3 |
popplerUbuntu:20.04:LTS From an advisory covering 2 CVEs | before 0.86.1-0ubuntu1.6, plus listed versions 0.80.0-0ubuntu10.80.0-0ubuntu30.80.0-0ubuntu40.80.0-0ubuntu50.85.0-1ubuntu1 Show 7 moreShow less0.85.0-1ubuntu30.86.1-0ubuntu10.86.1-0ubuntu1.10.86.1-0ubuntu1.20.86.1-0ubuntu1.30.86.1-0ubuntu1.40.86.1-0ubuntu1.5 | 0.86.1-0ubuntu1.6 |
popplerUbuntu:22.04:LTS From an advisory covering 2 CVEs | before 22.02.0-2ubuntu0.7, plus listed versions 21.06.1-121.11.0-1~ubuntu222.02.0-222.02.0-2ubuntu0.122.02.0-2ubuntu0.2 Show 4 moreShow less22.02.0-2ubuntu0.322.02.0-2ubuntu0.422.02.0-2ubuntu0.522.02.0-2ubuntu0.6 | 22.02.0-2ubuntu0.7 |
popplerUbuntu:24.04:LTS From an advisory covering 2 CVEs | before 24.02.0-1ubuntu9.3, plus listed versions 23.08.0-2ubuntu123.12.0-1ubuntu224.02.0-1ubuntu224.02.0-1ubuntu824.02.0-1ubuntu924.02.0-1ubuntu9.124.02.0-1ubuntu9.2 | 24.02.0-1ubuntu9.3 |
popplerUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs | before 0.41.0-0ubuntu1.16+esm6, plus listed versions 0.33.0-0ubuntu30.37.0-0ubuntu10.38.0-0ubuntu10.41.0-0ubuntu10.41.0-0ubuntu1.1 Show 20 moreShow less0.41.0-0ubuntu1.20.41.0-0ubuntu1.30.41.0-0ubuntu1.40.41.0-0ubuntu1.50.41.0-0ubuntu1.60.41.0-0ubuntu1.70.41.0-0ubuntu1.80.41.0-0ubuntu1.90.41.0-0ubuntu1.100.41.0-0ubuntu1.110.41.0-0ubuntu1.120.41.0-0ubuntu1.130.41.0-0ubuntu1.140.41.0-0ubuntu1.150.41.0-0ubuntu1.160.41.0-0ubuntu1.16+esm10.41.0-0ubuntu1.16+esm20.41.0-0ubuntu1.16+esm30.41.0-0ubuntu1.16+esm40.41.0-0ubuntu1.16+esm5 | 0.41.0-0ubuntu1.16+esm6 |
popplerUbuntu:Pro:18.04:LTS From an advisory covering 2 CVEs | before 0.62.0-2ubuntu2.14+esm5, plus listed versions 0.57.0-2ubuntu40.57.0-2ubuntu50.62.0-1ubuntu10.62.0-2ubuntu10.62.0-2ubuntu2 Show 17 moreShow less0.62.0-2ubuntu2.10.62.0-2ubuntu2.20.62.0-2ubuntu2.40.62.0-2ubuntu2.50.62.0-2ubuntu2.60.62.0-2ubuntu2.70.62.0-2ubuntu2.80.62.0-2ubuntu2.90.62.0-2ubuntu2.100.62.0-2ubuntu2.110.62.0-2ubuntu2.120.62.0-2ubuntu2.130.62.0-2ubuntu2.140.62.0-2ubuntu2.14+esm10.62.0-2ubuntu2.14+esm20.62.0-2ubuntu2.14+esm30.62.0-2ubuntu2.14+esm4 | 0.62.0-2ubuntu2.14+esm5 |
poppleropenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 25.04.0-1.1 | 25.04.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-32364 is a medium vulnerability (CVSS 4.0) in Freedesktop Poppler, published April 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in poppler 25.04.0-r0.
References
gitlab.freedesktop.org/poppler/poppler/-/issues/1574
lists.debian.org/debian-lts-announce/2025/04/msg00037.html
nvd.nist.gov/vuln/detail/CVE-2025-32364
github.com/advisories/GHSA-69gq-2xc5-f33j
docs.bell-sw.com/security/cves/CVE-2025-32364
Show 24 moreShow less
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1776760883.html
security-tracker.debian.org/tracker/CVE-2025-32364
advisories.mageia.org/MGASA-2025-0134.html
bugs.mageia.org/show_bug.cgi?id=34182
ubuntu.com/security/notices/USN-7426-1
lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/7MHRTVNCUQHLCEUDCYX24NK4ID3BMFG5
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1390
suse.com/support/update/announcement/2025/suse-su-202501780-1
bugzilla.suse.com/1240880
cve.org/CVERecord?id=CVE-2025-32364