CVE-2021-30860

CVE-2021-30860 affects Apple CoreGraphics in macOS/iOS/watchOS/tvOS stack. A vulnerability in integer overflow during processing of maliciously crafted PDFs could lead to arbitrary code execution. Fixed in Security Update 2021-005 for Catalina, iOS 14.8 / iPadOS 14.8, macOS Big Sur 11.6, and watc...

CVE-2022-38171

CVE-2022-38171 describes an integer overflow in the JBIG2 decoder of Xpdf (JBIG2Stream::readTextRegionSeg in JBIG2Stream.cc) that can crash or allow arbitrary code execution when processing a crafted PDF or JBIG2 image. Publicly documented impact aligns with prior CVEs (e.g., CVE-2021-30860) and ...

CVE-2025-32364

Poppler before 25.04.0 is affected by CVE-2025-32364 due to a floating-point exception in PSStack::roll, which may crash applications when handling malformed inputs involving INT_MIN. Upstream remediation is to upgrade to 25.04.0 or newer; multiple distributions have issued fixes (e.g., Mageia, F...

CVE-2025-32365

Affected software: Poppler (PDF rendering library). Vulnerability: CVE-2025-32365 allows an out-of-bounds read in JBIG2Bitmap::combine within JBIG2Stream.cc due to a misplaced isOk check. Impact (per sources): high confidentiality impact and high availability impact; attack vector LOCAL, user int...

CVE-2025-43903

Summary: CVE-2025-43903 affects Poppler NSSCryptoSignBackend.cc before 25.04.0, which does not verify adbe.pkcs7.sha1 signatures in PDF documents, enabling potential signature forgeries. What is affected: Poppler (NSSCryptoSignBackend.cc) in versions prior to 25.04.0. The vulnerability is describ...

CVE-2020-27778

CVE-2020-27778 = flaw in Poppler's pdftohtml when converting certain PDFs to HTML that could be exploited remotely to crash the application (DoS). Connected docs confirm affected Poppler/pdftohtml use and DoS impact; no explicit fixed version is provided in the supplied materials. Remediation: ap...

CVE-2018-10768

CVE-2018-10768 describes a NULL pointer dereference in Poppler’s AnnotPath::getCoordsLength (Annot.h) affecting Ubuntu’s Poppler 0.24.5. A crafted input can cause a remote denial of service. Multiple connected advisories note that later Poppler versions (e.g., 0.41.0) are not affected. Related do...

CVE-2018-21009

CVE-2018-21009 affects Poppler up to version 0.66.0, caused by an integer overflow in Parser::makeStream (Parser.cc). Connected advisories confirm this issue across several distributions; impact involves memory corruption with potential exploitation paths not detailed in these docs. Remediation p...

CVE-2024-6239

Poppler vulnerability CVE-2024-6239 affects the Pdfinfo utility. The issue triggers a crash (denial of service) when processing malformed input with the -dests parameter. Public advisories group this under Poppler/pdfinfo crash in broken documents, with a base CVSS around 7.5 (HIGH) and network a...

CVE-2007-3387

CVE-2007-3387 affects xpdf 3.02 and thus downstream KDE/kpdf/gpdf/pdfs handling in kdegraphics, CUPS, and related tools. The root cause is an integer/stack-based overflow in PDF parsing: StreamPredictor::getNextLine may overflow when processing a crafted PDF, potentially allowing remote code exec...

CVE-2018-19149

CVE-2018-19149 is a NULL pointer dereference in Poppler prior to 0.70.0, triggered when _poppler_attachment_new is called from poppler_annot_file_attachment_get_attachment. Affected products are Poppler up to version before 0.70.0; the issue is associated with a denial of service impact due to a ...

CVE-2023-34872

CVE-2023-34872 is a vulnerability in Poppler’s Outline.cc (OutlineItem::open) that can be triggered by a crafted PDF, enabling a remote attacker to cause a denial of service (crash). The affected component is Poppler prior to version 23.06.0. The description in the CVE entry confirms a DoS via a ...

CVE-2012-2142

CVE-2012-2142 affects Poppler up to version 0.21.4, where the error function in Error.cc can be abused by a crafted PDF containing an escape sequence for a terminal emulator to execute arbitrary commands. The vulnerability arises from improper handling of escape sequences in PDFs, enabling potent...

CVE-2025-52886

CVE-2025-52886 – Poppler : In Poppler versions prior to 25.06.0, reference counting uses 32-bit std::atomic_int, which can overflow and cause a use-after-free. The issue is fixed in version 25.06.0 (upgrade to >=25.06.0). No exploitation details are provided beyond that, and the documents do n...

CVE-2010-4653

CVE-2010-4653 describes an integer overflow in poppler before 0.16.3 when parsing CharCodes for fonts. Affected component: Poppler (fonts parsing). Root cause: integer overflow during CharCodes parsing. Impact as per sources: potential for overflow, with downstream effects described in OSV entrie...

CVE-2010-4654

Poppler before 0.16.3 has malformed commands that may cause stack corruption in the library. Affected component: poppler (pre-0.16.3). Impact per CVSS: HIGH with LOCAL attack vector, user interaction required; confidentiality, integrity, and availability for the affected scope can be compromised....

CVE-2025-50420

The CVE-2025-50420 entry concerns the pdfseparate utility of freedesktop poppler. The connected documents confirm a vulnerability in poppler v25.04.0 where a crafted PDF can cause infinite recursion, leading to Denial of Service (DoS). Several vendor advisories (SUSE SUSE-SU-2025:02791-1, SUSE-SU...