CVE-2021-25786

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code...

5.3 MediumFix available

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.54%Up 0.5 points since Aug 12, 2023

What each source reports

NVD Score used 5.3

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.

Record: CVE-2021-25786
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.

Record: CVE-2021-25786
Updated: 2026-11-02

EUVDEUVD-2021-12669 No score

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.

Record: EUVD-2021-12669
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f3pg-6m52-2j62 8.8

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code...

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.

Record: GHSA-f3pg-6m52-2j62
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSV 5.3

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.

Record: CVE-2021-25786
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-25786 5.3

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.

Record: DEBIAN-CVE-2021-25786
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVOESA-2023-1542 8.8

qpdf security update

QPDF is a command-line program that does structural, content-preserving transformations on PDF files. It could have been called something like pdf-to-pdf. It also provides many useful capabilities to developers of PDF-producing software or for people who just want to look at the innards of a PDF file to learn more about how they work.

Security Fix(es):

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.(CVE-2021-25786)

Record: OESA-2023-1542
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-25786 5.3

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.

Record: UBUNTU-CVE-2021-25786
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

Affected products

qpdf project qpdf

Affected packages

Affected packages
Package	Affected	Fixed
`qpdf` Debian:12	before 10.1.0-1	10.1.0-1
`qpdf` Debian:13	before 10.1.0-1	10.1.0-1
`qpdf` Debian:14	before 10.1.0-1	10.1.0-1
`qpdf` Debian:10 From an advisory covering 3 CVEs	before 8.4.0-2+deb10u1, plus listed versions 8.4.0-2	8.4.0-2+deb10u1
`qpdf` openEuler:20.03-LTS-SP1	before 8.4.2-4.oe1	8.4.2-4.oe1
`qpdf` openEuler:20.03-LTS-SP3	before 8.4.2-4.oe1	8.4.2-4.oe1
`qpdf` openEuler:22.03-LTS	before 8.4.2-4.oe2203sp2	8.4.2-4.oe2203sp2
`qpdf` openEuler:22.03-LTS-SP1	before 8.4.2-4.oe2203sp1	8.4.2-4.oe2203sp1
`qpdf` openEuler:22.03-LTS-SP2	before 8.4.2-4.oe2203sp2	8.4.2-4.oe2203sp2
`qpdf` Ubuntu:Pro:16.04:LTS	before 8.0.2-3~16.04.1+esm1, plus listed versions 5.1.3-25.1.3-35.2.0-15.2.0-26.0.0-28.0.2-3~16.04.1	8.0.2-3~16.04.1+esm1
`qpdf` Ubuntu:18.04:LTS	before 8.0.2-3ubuntu0.1, plus listed versions 7.0.0-17.1.0-17.1.1-18.0.0-18.0.1-18.0.2-18.0.2-3	8.0.2-3ubuntu0.1
`qpdf` Ubuntu:20.04:LTS	before 9.1.1-1ubuntu0.1, plus listed versions 8.4.2-19.0.2-19.1.0-19.1.1-19.1.1-1build1	9.1.1-1ubuntu0.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-25786 is a medium vulnerability (CVSS 5.3) in Qpdf Project Qpdf, published August 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in qpdf 10.1.0-1.

References

Show 4 moreShow less