Use-after-free in Poppler - CVE-2025-52886

Vulnerability identifier: #VU113638

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-52886

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when reading PDF files. A remote attacker can overflow the 32bit std::atomic_int counter, trigger memory corruption and potentially compromise the affected system.

Poppler
Gentoo Linux
Ubuntu
openEuler
Anolis OS
poppler (Ubuntu package)
poppler
poppler-help
poppler-glib-doc
poppler-utils
poppler-qt6-devel
poppler-qt6
poppler-qt5-devel
poppler-qt5
poppler-glib-devel
poppler-glib
poppler-devel
poppler-debugsource
poppler-debuginfo
poppler-cpp-devel
poppler-cpp
app-text/poppler
poppler-doc

Install updates from vendor's website.

Poppler - update to 25.06.0
poppler (Ubuntu package) - addressed in versions 0.41.0-0ubuntu1.16+esm7, 0.62.0-2ubuntu2.14+esm7, 0.86.1-0ubuntu1.7+esm1, 22.02.0-2ubuntu0.9, 24.02.0-1ubuntu9.5, 25.03.0-3ubuntu1.1
poppler - update to 23.12.0-9
poppler-help - update to 23.12.0-9
poppler-glib-doc - update to 23.12.0-9
poppler-utils - update to 23.12.0-9
poppler-qt6-devel - update to 23.12.0-9
poppler-qt6 - update to 23.12.0-9
poppler-qt5-devel - update to 23.12.0-9
poppler-qt5 - update to 23.12.0-9
poppler-glib-devel - update to 23.12.0-9
poppler-glib - update to 23.12.0-9
poppler-devel - update to 23.12.0-9
poppler-debugsource - update to 23.12.0-9
poppler-debuginfo - update to 23.12.0-9
poppler-cpp-devel - update to 23.12.0-9
poppler-cpp - update to 23.12.0-9
app-text/poppler - update to 25.06.0
poppler - update to 25.06.0-2
poppler-cpp - update to 25.06.0-2
poppler-cpp-devel - update to 25.06.0-2
poppler-devel - update to 25.06.0-2
poppler-glib - update to 25.06.0-2
poppler-glib-devel - update to 25.06.0-2
poppler-qt5 - update to 25.06.0-2
poppler-qt5-devel - update to 25.06.0-2
poppler-utils - update to 25.06.0-2
poppler-doc - update to 25.06.0-2
poppler-glib-doc - update to 25.06.0-2

• https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203
• https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5
• https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581
• https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828
• https://securitylab.github.com/advisories/GHSL-2025-054_poppler/

• Use-after-free in Poppler
• Ubuntu update for poppler
• openEuler update for poppler
• Ubuntu update for poppler
• Anolis OS update for poppler
• Gentoo update for Poppler