{"id":"CVE-2025-52886","aliases":["BELL-CVE-2025-52886","CLSA-2025-1765377802","CLSA-2026-1775817651","DEBIAN-CVE-2025-52886","EUVD-2025-19742","JLSEC-2026-90","MGASA-2025-0214","OESA-2025-1955","ROOT-OS-DEBIAN-12-CVE-2025-52886","SUSE-SU-2025:02317-1","SUSE-SU-2025:02318-1","SUSE-SU-2025:02324-1","SUSE-SU-2025:02356-1","SUSE-SU-2025:02357-1","UBUNTU-CVE-2025-52886","USN-7675-1","USN-7687-1","openSUSE-SU-2025:15323-1"],"status":"published","title":"Poppler Use After Free Vulnerability","description":"Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.","severity":{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00446,"percentile":0.39089,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2025-07-02T15:46:49Z","modified":"2026-10-28T10:51:42Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"poppler","fixed_in":["25.06.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler","fixed_in":["21.01.0-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-cpp","fixed_in":["21.01.0-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-cpp-devel","fixed_in":["21.01.0-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-devel","fixed_in":["21.01.0-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-glib","fixed_in":["21.01.0-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-glib-devel","fixed_in":["21.01.0-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-glib-doc","fixed_in":["21.01.0-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-qt5","fixed_in":["21.01.0-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-qt5-devel","fixed_in":["21.01.0-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-utils","fixed_in":["21.01.0-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler","fixed_in":["21.01.0-21.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-cpp","fixed_in":["21.01.0-21.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-cpp-devel","fixed_in":["21.01.0-21.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-devel","fixed_in":["21.01.0-21.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib","fixed_in":["21.01.0-21.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib-devel","fixed_in":["21.01.0-21.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib-doc","fixed_in":["21.01.0-21.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-qt5","fixed_in":["21.01.0-21.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-qt5-devel","fixed_in":["21.01.0-21.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-utils","fixed_in":["21.01.0-21.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"poppler","fixed_in":["22.12.0-2+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"poppler","fixed_in":["25.03.0-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"poppler","fixed_in":["25.03.0-5"],"sources":["osv"]},{"ecosystem":"Julia","package":"Poppler_jll","fixed_in":["25.10.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"poppler","fixed_in":["23.02.0-1.7.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"poppler","fixed_in":["23.12.0-9.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"poppler","fixed_in":["23.12.0-9.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"poppler","fixed_in":["0.90.0-12.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"poppler","fixed_in":["0.90.0-12.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"poppler","fixed_in":["0.90.0-12.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"poppler","fixed_in":["23.12.0-9.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"poppler","fixed_in":["0.43.0-16.58.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"poppler-qt","fixed_in":["0.43.0-16.58.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"poppler","fixed_in":["0.43.0-16.58.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"poppler-qt","fixed_in":["0.43.0-16.58.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"poppler","fixed_in":["23.01.0-150500.3.20.1","0.79.0-150200.3.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"poppler","fixed_in":["23.01.0-150500.3.20.1","0.79.0-150200.3.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"poppler","fixed_in":["23.01.0-150500.3.20.1","0.79.0-150200.3.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"poppler","fixed_in":["23.01.0-150500.3.20.1","0.79.0-150200.3.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"poppler","fixed_in":["24.03.0-150600.3.16.1","0.79.0-150200.3.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"poppler","fixed_in":["24.03.0-150600.3.16.1","0.79.0-150200.3.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler","fixed_in":["24.03.0-150600.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler-qt5","fixed_in":["24.03.0-150600.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler-qt6","fixed_in":["24.03.0-150600.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler","fixed_in":["24.03.0-150600.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler-qt5","fixed_in":["24.03.0-150600.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler-qt6","fixed_in":["24.03.0-150600.3.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"poppler","fixed_in":["24.03.0-150600.3.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"poppler-qt5","fixed_in":["24.03.0-150600.3.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"poppler-qt6","fixed_in":["24.03.0-150600.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"poppler","fixed_in":["0.79.0-150200.3.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"poppler","fixed_in":["0.79.0-150200.3.41.1","22.01.0-150400.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"poppler","fixed_in":["0.79.0-150200.3.41.1","22.01.0-150400.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"poppler","fixed_in":["0.79.0-150200.3.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"poppler","fixed_in":["0.79.0-150200.3.41.1","22.01.0-150400.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"poppler","fixed_in":["0.79.0-150200.3.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"poppler","fixed_in":["0.79.0-150200.3.41.1","22.01.0-150400.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"poppler","fixed_in":["0.79.0-150200.3.41.1","22.01.0-150400.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"poppler","fixed_in":["0.79.0-150200.3.41.1","22.01.0-150400.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"poppler","fixed_in":["0.79.0-150200.3.41.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"poppler","fixed_in":["0.41.0-0ubuntu1.16+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"poppler","fixed_in":["0.62.0-2ubuntu2.14+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"poppler","fixed_in":["0.86.1-0ubuntu1.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"poppler","fixed_in":["22.02.0-2ubuntu0.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"poppler","fixed_in":["24.02.0-1ubuntu9.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"poppler","fixed_in":["25.06.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.03.0-r1"},{"fixed":"25.06.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-glib-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-cpp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-glib-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"poppler-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.01.0-21.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.12.0-2+deb12u3"}]}],"versions":["22.12.0-2","22.12.0-2+deb12u1","22.12.0-2+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.03.0-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.03.0-5"}]}]},{"source":"osv","ecosystem":"Julia","package":"Poppler_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"25.10.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.0-1.7.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.12.0-9.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.12.0-9.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-12.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-12.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.90.0-12.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.12.0-9.oe2403"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.58.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.58.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.58.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"poppler-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.43.0-16.58.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.01.0-150500.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"poppler-qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"poppler-qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.03.0-150600.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.79.0-150200.3.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01.0-150400.3.31.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.16+esm7"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13","0.41.0-0ubuntu1.14","0.41.0-0ubuntu1.15","0.41.0-0ubuntu1.16","0.41.0-0ubuntu1.16+esm1","0.41.0-0ubuntu1.16+esm2","0.41.0-0ubuntu1.16+esm3","0.41.0-0ubuntu1.16+esm4","0.41.0-0ubuntu1.16+esm5","0.41.0-0ubuntu1.16+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+esm7"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8","0.62.0-2ubuntu2.9","0.62.0-2ubuntu2.10","0.62.0-2ubuntu2.11","0.62.0-2ubuntu2.12","0.62.0-2ubuntu2.13","0.62.0-2ubuntu2.14","0.62.0-2ubuntu2.14+esm1","0.62.0-2ubuntu2.14+esm2","0.62.0-2ubuntu2.14+esm3","0.62.0-2ubuntu2.14+esm4","0.62.0-2ubuntu2.14+esm5","0.62.0-2ubuntu2.14+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.86.1-0ubuntu1.7+esm1"}]}],"versions":["0.80.0-0ubuntu1","0.80.0-0ubuntu3","0.80.0-0ubuntu4","0.80.0-0ubuntu5","0.85.0-1ubuntu1","0.85.0-1ubuntu3","0.86.1-0ubuntu1","0.86.1-0ubuntu1.1","0.86.1-0ubuntu1.2","0.86.1-0ubuntu1.3","0.86.1-0ubuntu1.4","0.86.1-0ubuntu1.5","0.86.1-0ubuntu1.6","0.86.1-0ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.0-2ubuntu0.9"}]}],"versions":["21.06.1-1","21.11.0-1~ubuntu2","22.02.0-2","22.02.0-2ubuntu0.1","22.02.0-2ubuntu0.2","22.02.0-2ubuntu0.3","22.02.0-2ubuntu0.4","22.02.0-2ubuntu0.5","22.02.0-2ubuntu0.6","22.02.0-2ubuntu0.7","22.02.0-2ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.02.0-1ubuntu9.5"}]}],"versions":["23.08.0-2ubuntu1","23.12.0-1ubuntu2","24.02.0-1ubuntu2","24.02.0-1ubuntu8","24.02.0-1ubuntu9","24.02.0-1ubuntu9.1","24.02.0-1ubuntu9.2","24.02.0-1ubuntu9.3","24.02.0-1ubuntu9.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.02.0-2ubuntu0.9"}]}],"versions":["21.06.1-1","21.11.0-1~ubuntu2","22.02.0-2","22.02.0-2ubuntu0.1","22.02.0-2ubuntu0.2","22.02.0-2ubuntu0.3","22.02.0-2ubuntu0.4","22.02.0-2ubuntu0.5","22.02.0-2ubuntu0.6","22.02.0-2ubuntu0.7","22.02.0-2ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.02.0-1ubuntu9.5"}]}],"versions":["23.08.0-2ubuntu1","23.12.0-1ubuntu2","24.02.0-1ubuntu2","24.02.0-1ubuntu8","24.02.0-1ubuntu9","24.02.0-1ubuntu9.1","24.02.0-1ubuntu9.2","24.02.0-1ubuntu9.3","24.02.0-1ubuntu9.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-0ubuntu1.16+esm7"}]}],"versions":["0.33.0-0ubuntu3","0.37.0-0ubuntu1","0.38.0-0ubuntu1","0.41.0-0ubuntu1","0.41.0-0ubuntu1.1","0.41.0-0ubuntu1.2","0.41.0-0ubuntu1.3","0.41.0-0ubuntu1.4","0.41.0-0ubuntu1.5","0.41.0-0ubuntu1.6","0.41.0-0ubuntu1.7","0.41.0-0ubuntu1.8","0.41.0-0ubuntu1.9","0.41.0-0ubuntu1.10","0.41.0-0ubuntu1.11","0.41.0-0ubuntu1.12","0.41.0-0ubuntu1.13","0.41.0-0ubuntu1.14","0.41.0-0ubuntu1.15","0.41.0-0ubuntu1.16","0.41.0-0ubuntu1.16+esm1","0.41.0-0ubuntu1.16+esm2","0.41.0-0ubuntu1.16+esm3","0.41.0-0ubuntu1.16+esm4","0.41.0-0ubuntu1.16+esm5","0.41.0-0ubuntu1.16+esm6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-2ubuntu2.14+esm7"}]}],"versions":["0.57.0-2ubuntu4","0.57.0-2ubuntu5","0.62.0-1ubuntu1","0.62.0-2ubuntu1","0.62.0-2ubuntu2","0.62.0-2ubuntu2.1","0.62.0-2ubuntu2.2","0.62.0-2ubuntu2.4","0.62.0-2ubuntu2.5","0.62.0-2ubuntu2.6","0.62.0-2ubuntu2.7","0.62.0-2ubuntu2.8","0.62.0-2ubuntu2.9","0.62.0-2ubuntu2.10","0.62.0-2ubuntu2.11","0.62.0-2ubuntu2.12","0.62.0-2ubuntu2.13","0.62.0-2ubuntu2.14","0.62.0-2ubuntu2.14+esm1","0.62.0-2ubuntu2.14+esm2","0.62.0-2ubuntu2.14+esm3","0.62.0-2ubuntu2.14+esm4","0.62.0-2ubuntu2.14+esm5","0.62.0-2ubuntu2.14+esm6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.86.1-0ubuntu1.7+esm1"}]}],"versions":["0.80.0-0ubuntu1","0.80.0-0ubuntu3","0.80.0-0ubuntu4","0.80.0-0ubuntu5","0.85.0-1ubuntu1","0.85.0-1ubuntu3","0.86.1-0ubuntu1","0.86.1-0ubuntu1.1","0.86.1-0ubuntu1.2","0.86.1-0ubuntu1.3","0.86.1-0ubuntu1.4","0.86.1-0ubuntu1.5","0.86.1-0ubuntu1.6","0.86.1-0ubuntu1.7"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"poppler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.06.0-1.1"}]}]}],"products":[{"vendor":"freedesktop","product":"poppler"},{"vendor":"poppler","product":"poppler"}],"references":[{"url":"https://securitylab.github.com/advisories/GHSL-2025-054_poppler/","tags":["x_refsource_CONFIRM","Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581","tags":["x_refsource_MISC","Exploit","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828","tags":["x_refsource_MISC","Product","fix","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/11/5","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/12/1","tags":["web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-52886","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1765377802.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775817651.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52886.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52886","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-52886","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0214.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34485","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/11/5","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1955","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502317-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1245625","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52886","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502318-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502324-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502356-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502357-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-52886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52886","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7675-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7687-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-27337","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-52886","title":"Poppler Use After Free Vulnerability","description":"Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.","status":"published","published":"2025-07-02T15:46:49.733Z","modified":"2025-11-04T22:06:42.737Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:32:31.309974Z"}],"euvd":[{"id":"EUVD-2025-19742","description":"Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.","status":"published","published":"2025-07-02T15:46:49Z","modified":"2025-11-04T22:06:42Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:49:20.707326Z"}],"nvd":[{"id":"CVE-2025-52886","description":"Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.","status":"published","published":"2025-07-02T16:15:28.933Z","modified":"2026-06-17T09:37:12.977Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:11:15.754475Z"}],"osv":[{"id":"BELL-CVE-2025-52886","status":"published","published":"2025-07-03T06:00:33.849333Z","modified":"2026-01-26T09:40:30.682525Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-52886","title":"Poppler Use After Free Vulnerability","description":"Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.","status":"published","published":"2025-07-02T15:46:49.733Z","modified":"2026-10-28T10:51:42.258872912Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"DEBIAN-CVE-2025-52886","description":"Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.","status":"published","published":"2025-07-02T16:15:28.933Z","modified":"2026-09-01T20:05:53.789017905Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"JLSEC-2026-90","description":"Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.","status":"published","published":"2026-04-13T13:20:05.063Z","modified":"2026-07-18T00:02:24.268177891Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2025-1955","title":"poppler security update","description":"is a PDF rendering library.\r\n\r\nSecurity Fix(es):\n\nPoppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.(CVE-2025-52886)","status":"published","published":"2025-08-01T11:09:02Z","modified":"2026-08-18T01:18:56.002686766Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"UBUNTU-CVE-2025-52886","description":"Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.","status":"published","published":"2025-07-02T16:15:00Z","modified":"2026-04-22T16:04:46.715796Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"CLSA-2025-1765377802","title":"poppler: Fix of CVE-2025-52886","description":"- CVE-2025-52886: limit amount of annotations per page/document to mitigate out-of-memory","status":"published","published":"2025-12-10T14:43:26Z","modified":"2026-06-01T00:31:31.91189879Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1775817651","title":"poppler: Fix of CVE-2025-52886","description":"- CVE-2025-52886: limit amount of annotations per document/page to prevent\n  use-after-free via reference count overflow","status":"published","published":"2026-04-10T10:40:56Z","modified":"2026-06-01T00:32:46.93030601Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"MGASA-2025-0214","title":"Updated poppler packages fix security vulnerabilities","description":"poppler uses std::atomic_int for reference counting. Because it is only\n32 bits, it is possible to overflow the reference count and trigger a\nuse-after-free.\n","status":"published","published":"2025-07-25T21:48:21Z","modified":"2026-04-16T04:44:25.171680884Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15323-1","title":"libpoppler-cpp2-25.06.0-1.1 on GA media","description":"These are all security issues fixed in the libpoppler-cpp2-25.06.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-08T00:00:00Z","modified":"2026-03-23T04:53:38.928565Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-52886","title":"CVE-2025-52886 in poppler - Patched by Root","description":"Root has patched CVE-2025-52886 in the poppler package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-25T14:27:15Z","modified":"2026-10-08T13:00:07.237879026Z","updated_at":"2026-11-02T15:53:31.514195Z"},{"id":"SUSE-SU-2025:02317-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2025-52886: Fixed an integer overflow that can lead to a use-after-free. (bsc#1245625)\n","status":"published","published":"2025-07-15T12:59:44Z","modified":"2026-03-23T04:46:31.420903Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02318-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2025-52886: Fixed an integer overflow that can lead to a use-after-free. (bsc#1245625)\n","status":"published","published":"2025-07-15T13:00:31Z","modified":"2026-03-23T04:46:31.443384Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02324-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2025-52886: Fixed an integer overflow that can lead to a use-after-free. (bsc#1245625)\n","status":"published","published":"2025-07-16T06:37:12Z","modified":"2025-07-16T17:15:47.219328Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02356-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2025-52886: Fixed an integer overflow that can lead to a use-after-free. (bsc#1245625)\n","status":"published","published":"2025-07-17T14:14:36Z","modified":"2026-03-23T04:46:33.677156Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02357-1","title":"Security update for poppler","description":"This update for poppler fixes the following issues:\n\n- CVE-2025-52886: Fixed an integer overflow that can lead to a use-after-free. (bsc#1245625)\n","status":"published","published":"2025-07-17T14:15:52Z","modified":"2026-03-23T04:46:33.375096Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"USN-7675-1","title":"poppler vulnerability","description":"Kevin Backhouse discovered that poppler incorrectly handled documents with\na large number of annotations. If a user or automated system were tricked\ninto opening a specially crafted document, a remote attacker could use\nthis issue to cause poppler to consume resources, leading to a denial of\nservice, or possibly execute arbitrary code.","status":"published","published":"2025-07-28T11:48:01Z","modified":"2026-04-22T11:00:20.352035Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7687-1","title":"poppler vulnerabilities","description":"Jieyong Ma discovered that poppler incorrectly handled certain malformed\nPDF files. A remote attacker could possibly use this issue to cause poppler\nto crash, resulting in a denial of service. This issue only affected Ubuntu\n16.04 LTS and Ubuntu 18.04 LTS. (CVE-2022-27337)\n\nKevin Backhouse discovered that poppler incorrectly handled documents with\na large number of annotations. If a user or automated system were tricked\ninto opening a specially crafted document, a remote attacker could use\nthis issue to cause poppler to consume resources, leading to a denial of\nservice, or possibly execute arbitrary code. (CVE-2025-52886)","status":"published","published":"2025-08-06T14:06:57Z","modified":"2026-06-25T13:32:30.683893718Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}