Back to Database
Status published
Medium
CVE-2025-52886
Poppler Use After Free Vulnerability
Vulnerability Description
Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52886
Credits & Attribution
No credits recorded in the NVD database.
References
- https://securitylab.github.com/advisories/GHSL-2025-054_poppler/
- https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203
- https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5
- https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581
- https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828
More from poppler
View All →CVE-2025-52885
GHSL-2025-042: Poppler has Use-After-Free
Medium
6.1
CVE-2012-2142
The error function in Error.cc in poppler before 0.21.4 allows...
High
7.8
CVE-2010-4654
poppler before 0.16.3 has malformed commands that may cause corruption...
High
7.8
CVE-2010-4653
An integer overflow condition in poppler before 0.16.3 can occur...
Medium
6.5
CVE-2010-3704
The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in...
Medium
6.8
Affected Vendor
poppler
View all reports →Affected Software
poppler
Vulnerable Versions:
< 25.06.0
Timeline
Official Publish:
July 2nd, 2025
Last Modified:
November 4th, 2025
Added to House:
July 22nd, 2026