Search for vulnerabilities
Vulnerability details: VCID-chds-xndj-tffu
Vulnerability ID VCID-chds-xndj-tffu
Aliases CVE-2025-52886
Summary Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.
Status Published
Exploitability 0.5
Weighted Severity 3.8
Risk 1.9
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-416 Use After Free
System Score Found at
cvssv3 4.0 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-52886.json
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.0002 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-52886
cvssv3.1 7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv4 5.5 https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203
ssvc Track https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203
cvssv4 5.5 https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5
ssvc Track https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5
cvssv4 5.5 https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581
ssvc Track https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581
cvssv4 5.5 https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828
ssvc Track https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828
cvssv4 5.5 https://securitylab.github.com/advisories/GHSL-2025-054_poppler/
ssvc Track https://securitylab.github.com/advisories/GHSL-2025-054_poppler/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-52886.json
https://api.first.org/data/v1/epss?cve=CVE-2025-52886
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52886
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
04bd91684ed41d67ae0f10cde0660e4ed74ac203 https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203
1108784 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108784
1581 https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581
1828 https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828
2375930 https://bugzilla.redhat.com/show_bug.cgi?id=2375930
ac36affcc8486de38e8905a8d6547a3464ff46e5 https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5
CVE-2025-52886 https://nvd.nist.gov/vuln/detail/CVE-2025-52886
GHSL-2025-054_poppler https://securitylab.github.com/advisories/GHSL-2025-054_poppler/
USN-7675-1 https://usn.ubuntu.com/7675-1/
USN-7687-1 https://usn.ubuntu.com/7687-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-52886.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-02T15:59:12Z/ Found at https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-02T15:59:12Z/ Found at https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-02T15:59:12Z/ Found at https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-02T15:59:12Z/ Found at https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P Found at https://securitylab.github.com/advisories/GHSL-2025-054_poppler/
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-02T15:59:12Z/ Found at https://securitylab.github.com/advisories/GHSL-2025-054_poppler/
Exploit Prediction Scoring System (EPSS)
Percentile 0.03075
EPSS Score 0.00018
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:56:07.077717+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/7675-1/ 37.0.0