CVE-2025-52885
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Poppler, a PDF rendering library, contains a use-after-free (write) vulnerability in the StructTreeRoot class in versions prior to 25.10.0. The issue arises from using raw pointers to std::vector elements, which become dangling pointers when the vector is resized. Version 25.10.0 contains a patch.
Risk Assessment
Processing a specially crafted PDF file may lead to memory corruption, application crash, or potential code execution.
Recommendation
Upgrade Poppler to version 25.10.0 or later.
Other vulnerabilities in Poppler
See all- CVE-2017-15565High
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document.
- CVE-2017-14977High
The FoFiTrueType::getCFFBlock function in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack.
- CVE-2017-14976High
The FoFiType1C::convertToType0 function in Poppler 0.59.0 has a heap-based buffer over-read vulnerability when encountering an out-of-bounds font dictionary index. This can be exploited by an attacker to launch a denial of service attack.
- CVE-2017-14975High
The FoFiType1C::convertToType0 function in Poppler 0.59.0 has a NULL pointer dereference vulnerability because a data structure is not initialized, allowing an attacker to launch a denial of service attack.
- CVE-2017-14929High
In Poppler 0.59.0, memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opFill, Gfx::doPatternFill, Gfx::doTilingPatternFill, and Gfx::drawForm calls. This is a different vulnerability than CVE-2017-14519.
- CVE-2017-14617High
In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files.
- CVE-2017-14520High
In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when handling malicious PDF files.
- CVE-2017-14519High
In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).
- CVE-2017-14518High
In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document.
- CVE-2017-2820High
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of Poppler 0.53.0. Opening a specially crafted PDF file can lead to an overflow, resulting in out of bounds memory overwrite on the heap and potential arbitrary code execution.
Original NVD description (English source)
Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS