PT-2025-27644 · Poppler+7 · Poppler+7

Kevin Backhouse + 1 · Published 2025-06-03 · Updated 2025-11-13 · CVE-2025-52886

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Poppler versions prior to 25.06.0

Description: The issue is related to the use of std::atomic int for reference counting in the Poppler PDF rendering library. Since std::atomic int is only 32 bits, it is possible to overflow the reference count, which can trigger a use-after-free.

Recommendations: For versions prior to 25.06.0, update to version 25.06.0 to resolve the issue.

Exploit

Fix

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2025-14450

BDU:2025-11228

CVE-2025-52886

ECHO-3D5B-8DCE-6D87

MGASA-2025-0214

OESA-2025-1955

OPENSUSE-SU-2025:15323-1

SUSE-SU-2025:02317-1

SUSE-SU-2025:02318-1

SUSE-SU-2025:02324-1

SUSE-SU-2025:02356-1

SUSE-SU-2025:02357-1

SUSE-SU-2025_02317-1

SUSE-SU-2025_02318-1

SUSE-SU-2025_02324-1

SUSE-SU-2025_02356-1

SUSE-SU-2025_02357-1

USN-7675-1

USN-7687-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Poppler

Red Os

Suse

Ubuntu

References · 55

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52886.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2025-054_poppler · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:02317-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02324-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02357-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-52886 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7687-1 · Vendor Advisory
• https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203 · Patch
• https://osv.dev/vulnerability/CVE-2025-52886 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-52886 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0214 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-52886 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7687-1 · Vendor Advisory
• https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581 · Vendor Advisory