CVE-2025-43903
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures...
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
- Record
CVE-2025-43903- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2025-11892
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
- Record
EUVD-2025-11892- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4w9g-4h2x-7qxq
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures...
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
- Record
GHSA-4w9g-4h2x-7qxq- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
NVD
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
- Record
CVE-2025-43903- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSV
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
- Record
CVE-2025-43903- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-43903
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
- Record
DEBIAN-CVE-2025-43903- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 12 moreShow less
OSVJLSEC-2026-87
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on...
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
- Record
JLSEC-2026-87- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-1476
poppler security update
is a PDF rendering library.
Security Fix(es):
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.(CVE-2025-43903)
- Record
OESA-2025-1476- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-1477
poppler security update
is a PDF rendering library.
Security Fix(es):
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.(CVE-2025-43903)
- Record
OESA-2025-1477- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-2520
poppler security update
is a PDF rendering library.
Security Fix(es):
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.(CVE-2025-43903)
- Record
OESA-2025-2520- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-2521
poppler security update
is a PDF rendering library.
Security Fix(es):
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.(CVE-2025-43903)
- Record
OESA-2025-2521- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-2522
poppler security update
is a PDF rendering library.
Security Fix(es):
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.(CVE-2025-43903)
- Record
OESA-2025-2522- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-43903
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
- Record
UBUNTU-CVE-2025-43903- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1784038553 No score
poppler: Fix of CVE-2025-43903
- CVE-2025-43903: properly verify adbe.pkcs7.sha1 signatures in SignatureHandler::validateSignature to prevent signature forgeries
- Record
CLSA-2026-1784038553- Updated
- 2026-11-02
OSVCLSA-2026-1784899428 No score
poppler: Fix of CVE-2025-43903
- CVE-2025-43903: properly verify adbe.pkcs7.sha1 signatures in SignatureHandler::validateSignature to prevent signature forgeries
- Record
CLSA-2026-1784899428- Updated
- 2026-11-02
OSVMGASA-2025-0143 No score
Updated poppler packages fix security vulnerability
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries. (CVE-2025-43903)
- Record
MGASA-2025-0143- Updated
- 2026-11-02
OSVSUSE-SU-2025:1434-1 No score
Security update for poppler
This update for poppler fixes the following issues:
- CVE-2025-43903: improper verification of adbe.pkcs7.sha1 signatures allows for signature forgeries. (bsc#1241620)
- Record
SUSE-SU-2025:1434-1- Updated
- 2026-11-02
OSVUSN-7471-1 No score
poppler vulnerabilities
It was discovered that poppler did not properly verify adbe.pkcs7.sha1 signatures in PDF documents. An attacker could possibly use this issue to create documents with forged signatures that are treated as legitimately signed.
- Record
USN-7471-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els7 | 21.01.0-21.el9.tuxcare.els7 |
poppler-cppTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els7 | 21.01.0-21.el9.tuxcare.els7 |
poppler-cpp-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els7 | 21.01.0-21.el9.tuxcare.els7 |
poppler-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els7 | 21.01.0-21.el9.tuxcare.els7 |
poppler-glibTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els7 | 21.01.0-21.el9.tuxcare.els7 |
poppler-glib-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els7 | 21.01.0-21.el9.tuxcare.els7 |
poppler-glib-docTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els7 | 21.01.0-21.el9.tuxcare.els7 |
poppler-qt5TuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els7 | 21.01.0-21.el9.tuxcare.els7 |
poppler-qt5-develTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els7 | 21.01.0-21.el9.tuxcare.els7 |
poppler-utilsTuxCare:AlmaLinux:9.6 |
before 21.01.0-21.el9.tuxcare.els7 | 21.01.0-21.el9.tuxcare.els7 |
Show 31 moreShow less
| Package | Affected | Fixed |
|---|---|---|
popplerTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els7 | 21.01.0-14.el9_2.tuxcare.els7 |
poppler-cppTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els7 | 21.01.0-14.el9_2.tuxcare.els7 |
poppler-cpp-develTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els7 | 21.01.0-14.el9_2.tuxcare.els7 |
poppler-develTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els7 | 21.01.0-14.el9_2.tuxcare.els7 |
poppler-glibTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els7 | 21.01.0-14.el9_2.tuxcare.els7 |
poppler-glib-develTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els7 | 21.01.0-14.el9_2.tuxcare.els7 |
poppler-glib-docTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els7 | 21.01.0-14.el9_2.tuxcare.els7 |
poppler-qt5TuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els7 | 21.01.0-14.el9_2.tuxcare.els7 |
poppler-qt5-develTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els7 | 21.01.0-14.el9_2.tuxcare.els7 |
poppler-utilsTuxCare:AlmaLinux:9.2 |
before 21.01.0-14.el9_2.tuxcare.els7 | 21.01.0-14.el9_2.tuxcare.els7 |
popplerDebian:12 |
before 22.12.0-2+deb12u3, plus listed versions 22.12.0-222.12.0-2+deb12u122.12.0-2+deb12u2 |
22.12.0-2+deb12u3 |
popplerDebian:13 |
before 25.03.0-4 | 25.03.0-4 |
popplerDebian:14 |
before 25.03.0-4 | 25.03.0-4 |
Poppler_jllJulia |
before 25.10.0+0 | 25.10.0+0 |
popplerMageia:9 |
before 23.02.0-1.6.mga9 | 23.02.0-1.6.mga9 |
poppleropenEuler:24.03-LTS |
before 23.12.0-7.oe2403 | 23.12.0-7.oe2403 |
poppleropenEuler:24.03-LTS-SP1 |
before 23.12.0-7.oe2403sp1 | 23.12.0-7.oe2403sp1 |
poppleropenEuler:22.03-LTS-SP4 |
before 0.90.0-16.oe2203sp4 | 0.90.0-16.oe2203sp4 |
poppleropenEuler:20.03-LTS-SP4 |
before 0.90.0-16.oe2003sp4 | 0.90.0-16.oe2003sp4 |
poppleropenEuler:22.03-LTS-SP3 |
before 0.90.0-16.oe2203sp3 | 0.90.0-16.oe2203sp3 |
popplerSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 24.03.0-150600.3.13.1 | 24.03.0-150600.3.13.1 |
popplerSUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 24.03.0-150600.3.13.1 | 24.03.0-150600.3.13.1 |
poppler-qt5SUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 24.03.0-150600.3.13.1 | 24.03.0-150600.3.13.1 |
poppler-qt6SUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 24.03.0-150600.3.13.1 | 24.03.0-150600.3.13.1 |
poppleropenSUSE:Leap 15.6 |
before 24.03.0-150600.3.13.1 | 24.03.0-150600.3.13.1 |
poppler-qt5openSUSE:Leap 15.6 |
before 24.03.0-150600.3.13.1 | 24.03.0-150600.3.13.1 |
poppler-qt6openSUSE:Leap 15.6 |
before 24.03.0-150600.3.13.1 | 24.03.0-150600.3.13.1 |
popplerUbuntu:Pro:18.04:LTS |
before 0.62.0-2ubuntu2.14+esm6, plus listed versions 0.57.0-2ubuntu40.57.0-2ubuntu50.62.0-1ubuntu10.62.0-2ubuntu10.62.0-2ubuntu2 Show 18 moreShow less0.62.0-2ubuntu2.10.62.0-2ubuntu2.20.62.0-2ubuntu2.40.62.0-2ubuntu2.50.62.0-2ubuntu2.60.62.0-2ubuntu2.70.62.0-2ubuntu2.80.62.0-2ubuntu2.90.62.0-2ubuntu2.100.62.0-2ubuntu2.110.62.0-2ubuntu2.120.62.0-2ubuntu2.130.62.0-2ubuntu2.140.62.0-2ubuntu2.14+esm10.62.0-2ubuntu2.14+esm20.62.0-2ubuntu2.14+esm30.62.0-2ubuntu2.14+esm40.62.0-2ubuntu2.14+esm5 |
0.62.0-2ubuntu2.14+esm6 |
popplerUbuntu:20.04:LTS |
before 0.86.1-0ubuntu1.7, plus listed versions 0.80.0-0ubuntu10.80.0-0ubuntu30.80.0-0ubuntu40.80.0-0ubuntu50.85.0-1ubuntu1 Show 8 moreShow less0.85.0-1ubuntu30.86.1-0ubuntu10.86.1-0ubuntu1.10.86.1-0ubuntu1.20.86.1-0ubuntu1.30.86.1-0ubuntu1.40.86.1-0ubuntu1.50.86.1-0ubuntu1.6 |
0.86.1-0ubuntu1.7 |
popplerUbuntu:22.04:LTS |
before 22.02.0-2ubuntu0.8, plus listed versions 21.06.1-121.11.0-1~ubuntu222.02.0-222.02.0-2ubuntu0.122.02.0-2ubuntu0.2 Show 5 moreShow less22.02.0-2ubuntu0.322.02.0-2ubuntu0.422.02.0-2ubuntu0.522.02.0-2ubuntu0.622.02.0-2ubuntu0.7 |
22.02.0-2ubuntu0.8 |
popplerUbuntu:24.04:LTS |
before 24.02.0-1ubuntu9.4, plus listed versions 23.08.0-2ubuntu123.12.0-1ubuntu224.02.0-1ubuntu224.02.0-1ubuntu824.02.0-1ubuntu924.02.0-1ubuntu9.124.02.0-1ubuntu9.224.02.0-1ubuntu9.3 |
24.02.0-1ubuntu9.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-43903 is a medium vulnerability (CVSS 4.3) in Freedesktop Poppler, published April 18, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in poppler 21.01.0-21.el9.tuxcare.els7.
References
gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669
nvd.nist.gov/vuln/detail/CVE-2025-43903
github.com/advisories/GHSA-4w9g-4h2x-7qxq
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784038553.html
Show 14 moreShow less
security-tracker.debian.org/tracker/CVE-2025-43903
advisories.mageia.org/MGASA-2025-0143.html
bugs.mageia.org/show_bug.cgi?id=34238
ubuntu.com/security/notices/USN-7471-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1476
suse.com/support/update/announcement/2025/suse-su-20251434-1
bugzilla.suse.com/1241620
cve.org/CVERecord?id=CVE-2025-43903