PT-2025-40292 · Poppler+4 · Poppler+4

Shadowbyte1 · Published 2025-03-26 · Updated 2025-11-03 · CVE-2025-43718

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Poppler versions 24.06.1 through 25.04.0

Description The software is susceptible to a stack consumption issue leading to a SIGSEGV signal. This occurs when processing PDF documents containing deeply nested structures within their metadata, such as the GTS PDFEVersion field. The issue is present in functions including Dict::lookup, Catalog::getMetadata, and related functions within PDFDoc, specifically due to deep recursion in the regular expression executor (std:: detail:: Executor).

Recommendations Update to version 25.04.0 or later.

Exploit

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

BDU:2026-02903

CVE-2025-43718

ECHO-3E3B-EA76-5BA5

OESA-2025-2479

OESA-2025-2480

OESA-2025-2481

OESA-2025-2482

OESA-2025-2483

OESA-2025-2484

RHSA-2026:7364

SUSE-SU-2025:3779-1

SUSE-SU-2025:3898-1

SUSE-SU-2025:3900-1

SUSE-SU-2025:3910-1

SUSE-SU-2025_3779-1

SUSE-SU-2025_3900-1

SUSE-SU-2025_3910-1

USN-7803-1

Affected Products

Debian

Linuxmint

Poppler

Suse

Ubuntu

References · 42

• 🔥 https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-43718.md · Exploit
• https://osv.dev/vulnerability/OESA-2025-2479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52885 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-43718 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3900-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7803-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2484 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3910-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2482 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-43718 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2483 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-43718 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2480 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7803-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43718 · Vendor Advisory