DEBIAN-CVE-2025-52886

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2025-52886

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-52886.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2025-52886

Upstream

CVE-2025-52886

Published

2025-07-02T16:15:28Z

Modified

2025-09-19T06:25:50Z

Summary

[none]

Details

Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomic_int for reference counting. Because std::atomic_int is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

References

https://security-tracker.debian.org/tracker/CVE-2025-52886

Affected packages

Debian:13 / poppler

Package

Name: poppler
Purl: pkg:deb/debian/poppler?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

25.03.0-5

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / poppler

Package

Name: poppler
Purl: pkg:deb/debian/poppler?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

25.03.0-5

Ecosystem specific

{
    "urgency": "not yet assigned"
}