Skip to content
Fencer Vulns
medium 6.1

CVE-2025-52885 json

GHSL-2025-042: Poppler has Use-After-Free

published 2025-10-10 12 mo ago modified 2026-10-19 20 d ago also EUVD-2025-33795 , JLSEC-2026-89

cvss
6.1
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits
0
none known

Summary

Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.

Patch / fix

  • julia Poppler_jll 25.10.0+0
  • poppler poppler 25.10.0
  • poppler Debian 12 22.12.0-2+deb12u2
  • poppler Debian 13 25.03.0-5+deb13u3
  • poppler Debian 14 25.03.0-11.1

debian advisories DEBIAN-CVE-2025-52885

  • poppler Ubuntu 22.04 LTS 22.02.0-2ubuntu0.12
  • poppler Ubuntu 24.04 LTS 24.02.0-1ubuntu9.8
  • poppler Ubuntu 25.10 25.03.0-10ubuntu0.1
  • poppler Ubuntu Pro 20.04 LTS 0.86.1-0ubuntu1.7+esm3

ubuntu advisories UBUNTU-CVE-2025-52885

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • poppler hummingbird 1 26.01.0-7.hum1
  • poppler-cpp hummingbird 1 26.01.0-7.hum1
  • poppler-qt5 hummingbird 1 26.01.0-7.hum1
  • poppler-qt6 hummingbird 1 26.01.0-7.hum1
  • poppler-glib hummingbird 1 26.01.0-7.hum1
  • poppler-utils hummingbird 1 26.01.0-7.hum1

red hat advisories RHSA-2026:7364

  • poppler SLES for SAP applications 16.0, SLES 16.0 25.04.0-160000.3.1
  • poppler-qt6 SLES for SAP applications 16.0, SLES 16.0 25.04.0-160000.3.1
  • poppler SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +13 more 0.79.0-150200.3.46.1
  • poppler SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 23.01.0-150500.3.26.1
  • poppler SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, SLE Module for Basesystem 15 SP7 +2 more 24.03.0-150600.3.24.1
  • poppler-qt5 SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 24.03.0-150600.3.24.1
  • poppler-qt6 SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 24.03.0-150600.3.24.1

suse advisories SUSE-SU-2025:21132-1SUSE-SU-2025:3910-1SUSE-SU-2025:3900-1SUSE-SU-2025:3779-1

  • poppler openSUSE Leap 16.0 25.04.0-160000.3.1
  • poppler-qt5 openSUSE Leap 16.0 25.04.0-160000.3.1
  • poppler-qt6 openSUSE Leap 16.0 25.04.0-160000.3.1
  • poppler openSUSE Tumbleweed 25.09.1-2.1

opensuse advisories openSUSE-SU-2025:20068-1openSUSE-SU-2025:15648-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-52885 updated cvss 6.6

poppler: Use-After-Free in StructTreeRoot class

  • Red Hat Enterprise Linux 6 poppler, poppler-qt, poppler-qt4, poppler-glib, poppler-utils Red Hat Enterprise Linux 7 poppler, poppler-qt, poppler-cpp, poppler-glib, poppler-demos, poppler-utils, +4 more Red Hat Enterprise Linux 8 poppler, poppler-cpp, poppler-qt5, poppler-glib, poppler-utils
    affected: workaround, no fix planned “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability beyond the update recommendation.”
  • Red Hat Enterprise Linux 9 poppler, poppler-cpp, poppler-qt5, poppler-glib, poppler-utils Red Hat Enterprise Linux 10 poppler
    affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability beyond the update recommendation.”
  • Red Hat Hardened Images poppler 26.01.0-7.hum1, poppler-cpp 26.01.0-7.hum1, poppler-qt5 26.01.0-7.hum1, poppler-qt6 26.01.0-7.hum1, poppler-glib 26.01.0-7.hum1, poppler-utils 26.01.0-7.hum1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability beyond the update recommendation.” RHSA-2026:7364

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
12 mo ago

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
CNA 4.0 6.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
julia Poppler_jll
<25.10.0+0
25.10.0+0

Affected products

  • poppler poppler

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.