{"id":"CVE-2025-43718","aliases":["BELL-CVE-2025-43718","DEBIAN-CVE-2025-43718","EUVD-2025-32701","GHSA-77h4-r63x-87f8","OESA-2025-2479","OESA-2025-2480","OESA-2025-2481","OESA-2025-2482","OESA-2025-2483","OESA-2025-2484","RHSA-2026:7364","SUSE-SU-2025:3779-1","SUSE-SU-2025:3898-1","SUSE-SU-2025:3900-1","SUSE-SU-2025:3910-1","UBUNTU-CVE-2025-43718","USN-7803-1"],"status":"published","title":"Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply...","description":"Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00134,"percentile":0.02928,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2025-10-01T00:00:00Z","modified":"2026-10-28T11:01:41Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"poppler","fixed_in":["25.04.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"poppler","fixed_in":["22.12.0-2+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"poppler","fixed_in":["25.03.0-5+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"poppler","fixed_in":["25.03.0-10"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"poppler","fixed_in":["22.02.0-2ubuntu0.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"poppler","fixed_in":["24.02.0-1ubuntu9.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"poppler","fixed_in":["25.03.0-10"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"poppler","fixed_in":["25.03.0-10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.03.0-r1"},{"fixed":"25.04.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.12.0-2+deb12u2"}]}],"versions":["22.12.0-2","22.12.0-2+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.03.0-5+deb13u3"}]}],"versions":["25.03.0-5","25.03.0-5+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.03.0-10"}]}],"versions":["25.03.0-5","25.03.0-6","25.03.0-7","25.03.0-9"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-15.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.12.0-13.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.12.0-13.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.12.0-13.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-15.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-15.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-glib-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-qt6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13","0.41.0-0ubuntu1.14","0.41.0-0ubuntu1.15","0.41.0-0ubuntu1.16","0.41.0-0ubuntu1.16+esm1","0.41.0-0ubuntu1.16+esm2","0.41.0-0ubuntu1.16+esm3","0.41.0-0ubuntu1.16+esm4","0.41.0-0ubuntu1.16+esm5","0.41.0-0ubuntu1.16+esm6","0.41.0-0ubuntu1.16+esm7","0.41.0-0ubuntu1.16+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8","0.62.0-2ubuntu2.9","0.62.0-2ubuntu2.10","0.62.0-2ubuntu2.11","0.62.0-2ubuntu2.12","0.62.0-2ubuntu2.13","0.62.0-2ubuntu2.14","0.62.0-2ubuntu2.14+esm1","0.62.0-2ubuntu2.14+esm2","0.62.0-2ubuntu2.14+esm3","0.62.0-2ubuntu2.14+esm4","0.62.0-2ubuntu2.14+esm5","0.62.0-2ubuntu2.14+esm6","0.62.0-2ubuntu2.14+esm7","0.62.0-2ubuntu2.14+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.80.0-0ubuntu1","0.80.0-0ubuntu3","0.80.0-0ubuntu4","0.80.0-0ubuntu5","0.85.0-1ubuntu1","0.85.0-1ubuntu3","0.86.1-0ubuntu1","0.86.1-0ubuntu1.1","0.86.1-0ubuntu1.2","0.86.1-0ubuntu1.3","0.86.1-0ubuntu1.4","0.86.1-0ubuntu1.5","0.86.1-0ubuntu1.6","0.86.1-0ubuntu1.7","0.86.1-0ubuntu1.7+esm1","0.86.1-0ubuntu1.7+esm2","0.86.1-0ubuntu1.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.0-2ubuntu0.11"}]}],"versions":["21.06.1-1","21.11.0-1~ubuntu2","22.02.0-2","22.02.0-2ubuntu0.1","22.02.0-2ubuntu0.2","22.02.0-2ubuntu0.3","22.02.0-2ubuntu0.4","22.02.0-2ubuntu0.5","22.02.0-2ubuntu0.6","22.02.0-2ubuntu0.7","22.02.0-2ubuntu0.8","22.02.0-2ubuntu0.9","22.02.0-2ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.02.0-1ubuntu9.7"}]}],"versions":["23.08.0-2ubuntu1","23.12.0-1ubuntu2","24.02.0-1ubuntu2","24.02.0-1ubuntu8","24.02.0-1ubuntu9","24.02.0-1ubuntu9.1","24.02.0-1ubuntu9.2","24.02.0-1ubuntu9.3","24.02.0-1ubuntu9.4","24.02.0-1ubuntu9.5","24.02.0-1ubuntu9.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.03.0-10"}]}],"versions":["25.03.0-3","25.03.0-4","25.03.0-4build1","25.03.0-4ubuntu1","25.03.0-5","25.03.0-6","25.03.0-7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.03.0-10"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.0-2ubuntu0.11"}]}],"versions":["21.06.1-1","21.11.0-1~ubuntu2","22.02.0-2","22.02.0-2ubuntu0.1","22.02.0-2ubuntu0.2","22.02.0-2ubuntu0.3","22.02.0-2ubuntu0.4","22.02.0-2ubuntu0.5","22.02.0-2ubuntu0.6","22.02.0-2ubuntu0.7","22.02.0-2ubuntu0.8","22.02.0-2ubuntu0.9","22.02.0-2ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.02.0-1ubuntu9.7"}]}],"versions":["23.08.0-2ubuntu1","23.12.0-1ubuntu2","24.02.0-1ubuntu2","24.02.0-1ubuntu8","24.02.0-1ubuntu9","24.02.0-1ubuntu9.1","24.02.0-1ubuntu9.2","24.02.0-1ubuntu9.3","24.02.0-1ubuntu9.4","24.02.0-1ubuntu9.5","24.02.0-1ubuntu9.6"]}],"products":[{"vendor":"freedesktop","product":"poppler"},{"vendor":"poppler","product":"poppler"}],"references":[{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408","tags":["fix","article"]},{"url":"https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-43718.md","tags":["web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43718","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-77h4-r63x-87f8"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-43718","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43718.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-43718","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52885","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2480","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2481","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2482","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2483","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2484","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7364","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-52885","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-43718","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7364.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2400893","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-43718","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2403224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52885","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1884","tags":["article"]},{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1884#note_3114334","tags":["article"]},{"url":"https://securitylab.github.com/advisories/GHSL-2025-042_poppler/","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253779-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250908","tags":["report"]},{"url":"https://bugzilla.suse.com/1251940","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52885","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253898-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253900-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253910-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-43718","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7803-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-43718","description":"Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).","status":"published","published":"2025-10-01T00:00:00Z","modified":"2025-10-06T17:41:43.699Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:32:26.964524Z"}],"euvd":[{"id":"EUVD-2025-32701","description":"Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).","status":"published","published":"2025-10-01T00:00:00Z","modified":"2025-10-06T17:41:43Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:31:35.828093Z"}],"ghsa":[{"id":"GHSA-77h4-r63x-87f8","title":"Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply...","description":"Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).","status":"published","published":"2025-10-01T21:31:21Z","modified":"2025-10-01T21:31:21Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:03:49.634332Z"}],"nvd":[{"id":"CVE-2025-43718","description":"Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).","status":"published","published":"2025-10-01T19:15:35.683Z","modified":"2026-10-12T15:10:00.207Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:11:34.090044Z"}],"osv":[{"id":"BELL-CVE-2025-43718","status":"published","published":"2025-10-03T06:06:37.435188Z","modified":"2026-01-26T09:40:27.518437Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-43718","description":"Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).","status":"published","published":"2025-10-01T00:00:00Z","modified":"2026-10-28T11:01:41.586982773Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:44:49.394967Z"},{"id":"DEBIAN-CVE-2025-43718","description":"Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).","status":"published","published":"2025-10-01T19:15:35.683Z","modified":"2026-10-13T09:47:35.14681032Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"OESA-2025-2479","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:34Z","modified":"2026-08-18T01:19:14.943235983Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2480","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:34Z","modified":"2026-08-18T01:19:15.071662016Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2481","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:34Z","modified":"2026-08-18T01:19:15.170440918Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2482","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:34Z","modified":"2026-08-18T01:19:15.118700525Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2483","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:35Z","modified":"2026-08-18T01:19:15.146224627Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2484","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:35Z","modified":"2026-08-18T01:19:15.200261882Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2026:7364","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:14Z","modified":"2026-10-06T10:31:07.539916568Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2025-43718","description":"Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).","status":"published","published":"2025-10-02T00:00:00Z","modified":"2026-05-20T16:23:29.204908081Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"SUSE-SU-2025:3779-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n  - CVE-2025-43718: fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files (bsc#1250908)\n  - CVE-2025-52885: improved pointer handling that could have led to dangling pointers when the vector is resized (bsc#1251940)\n","status":"published","published":"2025-10-24T13:26:29Z","modified":"2026-02-04T02:13:34.387089Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3898-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n - CVE-2025-43718: fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files (bsc#1250908)\n","status":"published","published":"2025-10-31T14:55:48Z","modified":"2026-02-04T04:04:22.433032Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3900-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2025-43718: Fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files allows for stack exhaustion and denial of service (bsc#1250908).\n- CVE-2025-52885: Fixed raw pointers can lead to dangling pointers when the vector is resized (bsc#1251940).\n","status":"published","published":"2025-10-31T14:56:40Z","modified":"2026-02-04T02:52:27.867728Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3910-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n - CVE-2025-43718: fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files (bsc#1250908)\n - CVE-2025-52885: improved pointer handling that could have led to dangling pointers when the vector is resized (bsc#1251940)\n  ","status":"published","published":"2025-11-02T12:18:06Z","modified":"2026-03-23T04:51:21.19168Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"USN-7803-1","title":"poppler vulnerability","description":"It was discovered that poppler incorrectly handled certain PDF files. If a\nuser or automated system were tricked into opening a specially crafted\ndocument, a remote attacker could use this issue to cause poppler to crash,\nleading to a denial of service.","status":"published","published":"2025-10-06T12:32:13Z","modified":"2026-04-27T18:20:54.953848Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}