FreeDesktop Poppler

Poppler 26.07.0 FoFiTrueType Integer Overflow via segCnt
CVE-2026-93314 5.3 - Medium - September 18, 2026

A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue.

Integer Overflow or Wraparound

Poppler 26.07.0 Remote Integer Overflow in JBIG2Stream::readCodeTableSeg
CVE-2026-93313 5.3 - Medium - September 18, 2026

A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch.

Integer Overflow or Wraparound

Freedesktop Poppler JBIG2Stream NPE remote exploit, fixed in 26.08.0
CVE-2026-93312 5.3 - Medium - September 18, 2026

A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.

NULL Pointer Dereference

Poppler 26.07 Remote Integer Overflow in SampledFunction
CVE-2026-93311 5.3 - Medium - September 18, 2026

A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet.

Integer Overflow or Wraparound

Poppler 24.06.1-25.03: SEGV via deep metadata recursion (GTS_PDFEVersion)
CVE-2025-43718 2.9 - Low - October 01, 2025

Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).

Stack Exhaustion

Poppler v25.04.0 pdfseparate DoS via Infinite Recursion
CVE-2025-50420 6.5 - Medium - August 04, 2025

An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS).

Stack Exhaustion

OOB Read in Poppler <25.04 via JBIG2Bitmap::combine function
CVE-2025-32365 4 - Medium - April 05, 2025

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.

Out-of-bounds Read

Poppler <25.04.0 FP Exception in PSStack::roll Causes Crash
CVE-2025-32364 4 - Medium - April 05, 2025

A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.

Integer Overflow or Wraparound

Poppler: Out-of-Bounds Read in JBIG2Bitmap::combine Function
CVE-2024-56378 4.3 - Medium - December 23, 2024

libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.

Out-of-bounds Read

Poppler pdfinfo -dests Crash Causing DoS
CVE-2024-6239 7.5 - High - June 21, 2024

A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.

Improper Input Validation

Poppler 22.07.0 DOS via pdfunite.cc abort (stream check missing)
CVE-2022-37051 6.5 - Medium - August 22, 2023

An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.

assertion failure

Poppler 0.89.0 pdfinfo/pdftops DOS via Uncontrolled Recursion
CVE-2020-23804 7.5 - High - August 22, 2023

Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.

Stack Exhaustion

Poppler 22.07.0 Object::getString Assertion Denial of Service
CVE-2022-37052 6.5 - Medium - August 22, 2023

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.

assertion failure

Poppler 22.08.0 DoS via Assertion in Object.h (PDFDoc::replacePageDict)
CVE-2022-38349 6.5 - Medium - August 22, 2023

An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.

assertion failure

Poppler 22.07.0 PDFDoc::savePageAs DoS via mishandled xref
CVE-2022-37050 6.5 - Medium - August 22, 2023

In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.

CVE202018839: Poppler 0.75.0 Buffer Overflow in HtmlOutputDev::page (pre-0.75.1)
CVE-2020-18839 - August 22, 2023

Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service.

Poppler 20.12.1 Remote DoS via FoFiType1C::cvtGlyph (crafted PDF)
CVE-2020-36023 6.5 - Medium - August 11, 2023

An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function.

Infinite Loop

Poppler 20.12.1 DoS via FoFiType1C::convertToType1
CVE-2020-36024 5.5 - Medium - August 11, 2023

An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function.

NULL Pointer Dereference

Outline.cc Poppler <23.06.0 DoS via crafted PDF (OutlineItem::open)
CVE-2023-34872 5.5 - Medium - July 31, 2023

A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in OutlineItem::open.

Resource Exhaustion

Poppler <=22.08.0 Integer Overflow in JBIG2 Decoder
CVE-2022-38784 7.8 - High - August 30, 2022

Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.

Integer Overflow or Wraparound

CVE-2022-38171: Xpdf <=4.04 JBIG2 int overflow leading to code exec
CVE-2022-38171 7.8 - High - August 22, 2022

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).

Integer Overflow or Wraparound

A logic error in the Hints::Hints function of Poppler v22.03.0
CVE-2022-27337 6.5 - Medium - May 05, 2022

A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

An integer overflow was addressed with improved input validation
CVE-2021-30860 7.8 - High - August 24, 2021

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Integer Overflow or Wraparound

DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document
CVE-2020-35702 7.8 - High - December 25, 2020

DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects

Memory Corruption

A flaw was found in Poppler in the way certain PDF files were converted into HTML
CVE-2020-27778 7.5 - High - December 03, 2020

A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.

Access of Uninitialized Pointer

An integer overflow condition in poppler before 0.16.3
CVE-2010-4653 6.5 - Medium - November 13, 2019

An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.

Integer Overflow or Wraparound

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.
CVE-2018-21009 - September 05, 2019

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.

An issue was discovered in Poppler through 0.78.0
CVE-2019-14494 - August 01, 2019

An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.

The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length
CVE-2019-9959 6.5 - Medium - July 22, 2019

The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.

Integer Overflow or Wraparound

In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc
CVE-2019-12293 - May 23, 2019

In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.

FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion
CVE-2019-11026 6.5 - Medium - April 08, 2019

FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.

Stack Exhaustion

An issue was discovered in Poppler 0.74.0
CVE-2019-10873 6.5 - Medium - April 05, 2019

An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc.

NULL Pointer Dereference

An issue was discovered in Poppler 0.74.0
CVE-2019-10872 8.8 - High - April 05, 2019

An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc.

Out-of-bounds Read

An issue was discovered in Poppler 0.74.0
CVE-2019-10871 6.5 - Medium - April 05, 2019

An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.

Out-of-bounds Read

PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc
CVE-2019-9903 6.5 - Medium - March 21, 2019

PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.

Memory Corruption

Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.
CVE-2019-9631 - March 08, 2019

Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.

An issue was discovered in Poppler 0.74.0
CVE-2019-9543 - March 01, 2019

An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.

An issue was discovered in Poppler 0.74.0
CVE-2019-9545 - March 01, 2019

An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0
CVE-2019-9200 - February 26, 2019

A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc)
CVE-2019-7310 7.8 - High - February 03, 2019

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.

Out-of-bounds Read

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc
CVE-2018-20662 - January 03, 2019

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.

A reachable Object::dictLookup assertion in Poppler 0.72.0
CVE-2018-20650 - January 01, 2019

A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.

A reachable Object::getString assertion in Poppler 0.72.0
CVE-2018-20551 - December 28, 2018

A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c.

XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which
CVE-2018-20481 - December 26, 2018

XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.

Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called
CVE-2018-19149 6.5 - Medium - November 10, 2018

Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.

NULL Pointer Dereference

An issue was discovered in Poppler 0.71.0
CVE-2018-19058 6.5 - Medium - November 07, 2018

An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.

Always-Incorrect Control Flow Implementation

An issue was discovered in Poppler 0.71.0
CVE-2018-19059 6.5 - Medium - November 07, 2018

An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.

Out-of-bounds Read

An issue was discovered in Poppler 0.71.0
CVE-2018-19060 6.5 - Medium - November 07, 2018

An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.

NULL Pointer Dereference

An issue was discovered in Poppler 0.71.0
CVE-2018-18897 6.5 - Medium - November 02, 2018

An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.

Missing Release of Resource after Effective Lifetime

In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file
CVE-2018-16646 6.5 - Medium - September 06, 2018

In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.

Infinite Loop