CVE-2024-56378 Memory corruption in n/a

Medium 4.3 Published 22 Dec 2024 Updated 3 Nov 2025

An out-of-bounds read in Poppler's JBIG2Bitmap::combine function allows attackers to cause denial of service or disclose information via crafted PDFs.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-56378?

CVE-2024-56378 is a medium-severity memory corruption vulnerability in Freedesktop Poppler, published on 22 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.

Weakness: CWE-125

Which versions are affected by CVE-2024-56378?

It affects 1 product.

Linux distribution packages (14)

`poppler` SUSE:Linux Enterprise Module for Basesystem 15 SP6	All versions	`0.79.0-150200.3.35.1`
`poppler` SUSE:Linux Enterprise Module for Basesystem 15 SP6	All versions	`24.03.0-150600.3.5.1`
`poppler` SUSE:Linux Enterprise Module for Package Hub 15 SP6	All versions	`24.03.0-150600.3.5.1`
`poppler-qt5` SUSE:Linux Enterprise Module for Package Hub 15 SP6	All versions	`24.03.0-150600.3.5.1`
`poppler-qt6` SUSE:Linux Enterprise Module for Package Hub 15 SP6	All versions	`24.03.0-150600.3.5.1`
`poppler` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`0.43.0-16.52.1`
`poppler-qt` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`0.43.0-16.52.1`
`poppler` openSUSE:Leap 15.5	All versions	`23.01.0-150500.3.14.1`
`poppler-qt5` openSUSE:Leap 15.5	All versions	`23.01.0-150500.3.14.1`
`poppler-qt6` openSUSE:Leap 15.5	All versions	`23.01.0-150500.3.14.1`
`poppler` openSUSE:Leap 15.6	All versions	`24.03.0-150600.3.5.1`
`poppler-qt5` openSUSE:Leap 15.6	All versions	`24.03.0-150600.3.5.1`
`poppler-qt6` openSUSE:Leap 15.6	All versions	`24.03.0-150600.3.5.1`
`poppler` openSUSE:Tumbleweed	All versions	`24.12.0-1.1`

Products include Freedesktop Poppler.

How do I fix CVE-2024-56378?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-56378 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-56378 exists.

All Freedesktop Poppler vulnerabilities

Sources

Also known as BELL-CVE-2024-56378, CLSA-2026-1787750503, CLSA-2026-1788270342, DEBIAN-CVE-2024-56378, GHSA-h369-f67q-2q4c, JLSEC-2026-83 and 11 more.