{"id":"CVE-2025-52885","aliases":["BELL-CVE-2025-52885","DEBIAN-CVE-2025-52885","EUVD-2025-33795","JLSEC-2026-89","MGASA-2025-0251","OESA-2025-2479","OESA-2025-2480","OESA-2025-2481","OESA-2025-2482","OESA-2025-2483","OESA-2025-2484","RHSA-2026:7364","SUSE-SU-2025:21132-1","SUSE-SU-2025:3779-1","SUSE-SU-2025:3900-1","SUSE-SU-2025:3910-1","UBUNTU-CVE-2025-52885","USN-7858-1","openSUSE-SU-2025:15648-1","openSUSE-SU-2025:20068-1"],"status":"published","title":"GHSL-2025-042: Poppler has Use-After-Free","description":"Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.","severity":{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00172,"percentile":0.06647,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2025-10-10T22:11:20Z","modified":"2026-10-23T17:47:27Z","fixes":[{"ecosystem":"Alpaquita:23","package":"poppler","fixed_in":["22.11.0-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"poppler","fixed_in":["25.04.0-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"poppler","fixed_in":["25.09.1-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"poppler","fixed_in":["22.12.0-2+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"poppler","fixed_in":["25.03.0-5+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"poppler","fixed_in":["25.03.0-11.1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Poppler_jll","fixed_in":["25.10.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"poppler","fixed_in":["23.02.0-1.8.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"poppler","fixed_in":["25.04.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"poppler-qt6","fixed_in":["25.04.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"poppler","fixed_in":["25.04.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"poppler-qt6","fixed_in":["25.04.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"poppler","fixed_in":["0.86.1-0ubuntu1.7+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"poppler","fixed_in":["22.02.0-2ubuntu0.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"poppler","fixed_in":["24.02.0-1ubuntu9.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"poppler","fixed_in":["25.03.0-10ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"poppler","fixed_in":["25.09.1-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"poppler","fixed_in":["25.04.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"poppler-qt5","fixed_in":["25.04.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"poppler-qt6","fixed_in":["25.04.0-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.11.0-r0"},{"fixed":"22.11.0-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.04.0-r0"},{"fixed":"25.04.0-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.03.0-r1"},{"fixed":"25.09.1-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.12.0-2+deb12u2"}]}],"versions":["22.12.0-2","22.12.0-2+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.03.0-5+deb13u3"}]}],"versions":["25.03.0-5","25.03.0-5+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.03.0-11.1"}]}],"versions":["25.03.0-10","25.03.0-11","25.03.0-5","25.03.0-6","25.03.0-7","25.03.0-9"]},{"source":"osv","ecosystem":"Julia","package":"Poppler_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"25.10.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.0-1.8.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-15.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.12.0-13.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.12.0-13.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.12.0-13.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-15.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-15.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-glib-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-qt6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.01.0-7.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.04.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.04.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.04.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.04.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.86.1-0ubuntu1.7+esm3"}]}],"versions":["0.80.0-0ubuntu1","0.80.0-0ubuntu3","0.80.0-0ubuntu4","0.80.0-0ubuntu5","0.85.0-1ubuntu1","0.85.0-1ubuntu3","0.86.1-0ubuntu1","0.86.1-0ubuntu1.1","0.86.1-0ubuntu1.2","0.86.1-0ubuntu1.3","0.86.1-0ubuntu1.4","0.86.1-0ubuntu1.5","0.86.1-0ubuntu1.6","0.86.1-0ubuntu1.7","0.86.1-0ubuntu1.7+esm1","0.86.1-0ubuntu1.7+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.0-2ubuntu0.12"}]}],"versions":["21.06.1-1","21.11.0-1~ubuntu2","22.02.0-2","22.02.0-2ubuntu0.1","22.02.0-2ubuntu0.2","22.02.0-2ubuntu0.3","22.02.0-2ubuntu0.4","22.02.0-2ubuntu0.5","22.02.0-2ubuntu0.6","22.02.0-2ubuntu0.7","22.02.0-2ubuntu0.8","22.02.0-2ubuntu0.9","22.02.0-2ubuntu0.10","22.02.0-2ubuntu0.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.02.0-1ubuntu9.8"}]}],"versions":["23.08.0-2ubuntu1","23.12.0-1ubuntu2","24.02.0-1ubuntu2","24.02.0-1ubuntu8","24.02.0-1ubuntu9","24.02.0-1ubuntu9.1","24.02.0-1ubuntu9.2","24.02.0-1ubuntu9.3","24.02.0-1ubuntu9.4","24.02.0-1ubuntu9.5","24.02.0-1ubuntu9.6","24.02.0-1ubuntu9.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.03.0-10ubuntu0.1"}]}],"versions":["25.03.0-3","25.03.0-4","25.03.0-4build1","25.03.0-4ubuntu1","25.03.0-5","25.03.0-6","25.03.0-7","25.03.0-10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.86.1-0ubuntu1.7+esm3"}]}],"versions":["0.80.0-0ubuntu1","0.80.0-0ubuntu3","0.80.0-0ubuntu4","0.80.0-0ubuntu5","0.85.0-1ubuntu1","0.85.0-1ubuntu3","0.86.1-0ubuntu1","0.86.1-0ubuntu1.1","0.86.1-0ubuntu1.2","0.86.1-0ubuntu1.3","0.86.1-0ubuntu1.4","0.86.1-0ubuntu1.5","0.86.1-0ubuntu1.6","0.86.1-0ubuntu1.7","0.86.1-0ubuntu1.7+esm1","0.86.1-0ubuntu1.7+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.0-2ubuntu0.12"}]}],"versions":["21.06.1-1","21.11.0-1~ubuntu2","22.02.0-2","22.02.0-2ubuntu0.1","22.02.0-2ubuntu0.2","22.02.0-2ubuntu0.3","22.02.0-2ubuntu0.4","22.02.0-2ubuntu0.5","22.02.0-2ubuntu0.6","22.02.0-2ubuntu0.7","22.02.0-2ubuntu0.8","22.02.0-2ubuntu0.9","22.02.0-2ubuntu0.10","22.02.0-2ubuntu0.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.02.0-1ubuntu9.8"}]}],"versions":["23.08.0-2ubuntu1","23.12.0-1ubuntu2","24.02.0-1ubuntu2","24.02.0-1ubuntu8","24.02.0-1ubuntu9","24.02.0-1ubuntu9.1","24.02.0-1ubuntu9.2","24.02.0-1ubuntu9.3","24.02.0-1ubuntu9.4","24.02.0-1ubuntu9.5","24.02.0-1ubuntu9.6","24.02.0-1ubuntu9.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.03.0-10ubuntu0.1"}]}],"versions":["25.03.0-3","25.03.0-4","25.03.0-4build1","25.03.0-4ubuntu1","25.03.0-5","25.03.0-6","25.03.0-7","25.03.0-10"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.09.1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.04.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.04.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.04.0-160000.3.1"}]}]}],"products":[{"vendor":"poppler","product":"poppler"}],"references":[{"url":"https://securitylab.github.com/advisories/GHSL-2025-042_poppler/","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1884","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1884#note_3114334","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/10/13/2","tags":["web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-52885","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-52885","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0251.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34668","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/10/13/2","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52885","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2480","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2481","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2482","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2483","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2484","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7364","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-52885","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-43718","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7364.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2400893","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-43718","tags":["advisory"]},{"url":"https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-43718.md","tags":["article"]},{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2403224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52885","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521132-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1251940","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52885","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253779-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250908","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43718","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253900-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253910-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-52885","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7858-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-52885","title":"GHSL-2025-042: Poppler has Use-After-Free","description":"Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.","status":"published","published":"2025-10-10T22:11:20.494Z","modified":"2025-11-04T21:11:41.075Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:32:31.309974Z"}],"euvd":[{"id":"EUVD-2025-33795","description":"Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.","status":"published","published":"2025-10-10T22:11:20Z","modified":"2025-11-04T21:11:41Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T19:49:21.143143Z"}],"nvd":[{"id":"CVE-2025-52885","description":"Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.","status":"published","published":"2025-10-10T23:15:36.397Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:11:36.851295Z"}],"osv":[{"id":"CVE-2025-52885","title":"GHSL-2025-042: Poppler has Use-After-Free","description":"Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.","status":"published","published":"2025-10-10T22:11:20Z","modified":"2026-04-16T04:39:16.987201244Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"DEBIAN-CVE-2025-52885","description":"Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.","status":"published","published":"2025-10-10T23:15:36.397Z","modified":"2026-10-23T17:47:27.262455778Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"JLSEC-2026-89","description":"Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.","status":"published","published":"2026-04-13T13:20:05.063Z","modified":"2026-07-18T00:02:24.226684894Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2025-2479","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:34Z","modified":"2026-08-18T01:19:14.943235983Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2480","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:34Z","modified":"2026-08-18T01:19:15.071662016Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2481","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:34Z","modified":"2026-08-18T01:19:15.170440918Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2482","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:34Z","modified":"2026-08-18T01:19:15.118700525Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2483","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:35Z","modified":"2026-08-18T01:19:15.146224627Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2484","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).(CVE-2025-43718)\n\nPoppler is a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector` stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.(CVE-2025-52885)","status":"published","published":"2025-10-17T11:09:35Z","modified":"2026-08-18T01:19:15.200261882Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2026:7364","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:14Z","modified":"2026-10-06T10:31:07.539916568Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2025-52885","description":"Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.","status":"published","published":"2025-10-10T23:15:00Z","modified":"2026-04-22T16:05:44.695485Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"BELL-CVE-2025-52885","status":"published","published":"2025-10-14T06:04:43.90915Z","modified":"2026-01-26T09:40:31.355831Z","updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"MGASA-2025-0251","title":"Updated poppler packages fix security vulnerability","description":"Use After Free (UAF) in Poppler. (CVE-2025-52885)\n","status":"published","published":"2025-10-29T04:28:16Z","modified":"2026-04-16T04:44:23.205151418Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15648-1","title":"libpoppler-cpp2-25.09.1-2.1 on GA media","description":"These are all security issues fixed in the libpoppler-cpp2-25.09.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-18T00:00:00Z","modified":"2026-03-23T04:54:03.130199Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:20068-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2025-52885: Fixed raw pointers leading to dangling pointers when the vector is resized (bsc#1251940)\n","status":"published","published":"2025-11-20T13:33:03Z","modified":"2026-03-23T04:54:16.401241Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2025:21132-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2025-52885: Fixed raw pointers leading to dangling pointers when the vector is resized (bsc#1251940)\n","status":"published","published":"2025-11-20T13:33:08Z","modified":"2026-03-23T04:49:17.146275Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3779-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n  - CVE-2025-43718: fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files (bsc#1250908)\n  - CVE-2025-52885: improved pointer handling that could have led to dangling pointers when the vector is resized (bsc#1251940)\n","status":"published","published":"2025-10-24T13:26:29Z","modified":"2026-02-04T02:13:34.387089Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3900-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2025-43718: Fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files allows for stack exhaustion and denial of service (bsc#1250908).\n- CVE-2025-52885: Fixed raw pointers can lead to dangling pointers when the vector is resized (bsc#1251940).\n","status":"published","published":"2025-10-31T14:56:40Z","modified":"2026-02-04T02:52:27.867728Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3910-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n - CVE-2025-43718: fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files (bsc#1250908)\n - CVE-2025-52885: improved pointer handling that could have led to dangling pointers when the vector is resized (bsc#1251940)\n  ","status":"published","published":"2025-11-02T12:18:06Z","modified":"2026-03-23T04:51:21.19168Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"USN-7858-1","title":"poppler vulnerability","description":"It was discovered that poppler incorrectly handled certain PDF files.\nAn attacker could possibly use this issue to cause a crash.","status":"published","published":"2025-11-05T08:56:52Z","modified":"2026-04-22T11:03:30.800425Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}