CVE-2025-52886
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-52886
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-52886.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-52886
- Downstream
- Related
- Published
- 2025-07-02T16:15:28Z
- Modified
- 2025-07-03T16:47:58.022592Z
- Summary
- [none]
- Details
-
Poppler is a PDF rendering library. Versions prior to 25.06.0 use
std::atomic_intfor reference counting. Becausestd::atomic_intis only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue. - References
-
- https://securitylab.github.com/advisories/GHSL-2025-054_poppler/
- https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203
- https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5
- https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581
- https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828
- https://security-tracker.debian.org/tracker/CVE-2025-52886
Affected packages
Debian:11 / poppler
Package
- Name
- poppler
- Purl
- pkg:deb/debian/poppler?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
20.*
20.09.0-3.1
20.09.0-3.1+deb11u1
20.09.0-3.1+deb11u2
21.*
21.02.0-1
21.06.0-1
21.06.1-1
21.11.0-1
22.*
22.02.0-1
22.02.0-2
22.02.0-3
22.06.0-1
22.08.0-1
22.08.0-2
22.08.0-2.1
22.11.0-1
22.12.0-1
22.12.0-2
22.12.0-2.1
22.12.0-2.2
23.*
23.08.0-1
23.08.0-2
23.12.0-1
24.*
24.02.0-1
24.02.0-2
24.02.0-3
24.02.0-4
24.02.0-5
24.02.0-5+loong64
24.06.0-1
24.06.0-2
24.08.0-1
24.08.0-2
24.08.0-3
24.08.0-4
25.*
25.01.0-1
25.01.0-2
25.01.0-3
25.01.0-4
25.01.0-5
25.03.0-1
25.03.0-2
25.03.0-3
25.03.0-4
Debian:12 / poppler
Package
- Name
- poppler
- Purl
- pkg:deb/debian/poppler?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
22.*
22.12.0-2
22.12.0-2+deb12u1
22.12.0-2.1
22.12.0-2.2
23.*
23.08.0-1
23.08.0-2
23.12.0-1
24.*
24.02.0-1
24.02.0-2
24.02.0-3
24.02.0-4
24.02.0-5
24.02.0-5+loong64
24.06.0-1
24.06.0-2
24.08.0-1
24.08.0-2
24.08.0-3
24.08.0-4
25.*
25.01.0-1
25.01.0-2
25.01.0-3
25.01.0-4
25.01.0-5
25.03.0-1
25.03.0-2
25.03.0-3
25.03.0-4
Debian:13 / poppler
Package
- Name
- poppler
- Purl
- pkg:deb/debian/poppler?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
22.*
22.12.0-2
22.12.0-2.1
22.12.0-2.2
23.*
23.08.0-1
23.08.0-2
23.12.0-1
24.*
24.02.0-1
24.02.0-2
24.02.0-3
24.02.0-4
24.02.0-5
24.02.0-5+loong64
24.06.0-1
24.06.0-2
24.08.0-1
24.08.0-2
24.08.0-3
24.08.0-4
25.*
25.01.0-1
25.01.0-2
25.01.0-3
25.01.0-4
25.01.0-5
25.03.0-1
25.03.0-2
25.03.0-3
25.03.0-4