PT-2025-41613 · Poppler+5 · Poppler+5
CVSS v4.0
6.1
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
Name of the Vulnerable Software and Affected Versions
Poppler versions prior to 25.10.0
Description
Poppler is a library used for rendering PDF files and modifying their structure. A use-after-free (write) issue exists due to the use of raw pointers to elements within a
std::vector in the StructTreeRoot class. This can result in dangling pointers when the vector is resized. The vulnerability originates from how refToParentMap stores references to std::vector elements using raw pointers, which become invalid upon vector resizing. A std::vector reallocates memory and moves elements when it reaches capacity, invalidating any previously stored raw pointers to those elements.Recommendations
Update to Poppler version 25.10.0 or later.
Fix
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Poppler
Red Os
Suse
Ubuntu