CVE-2025-50420 Denial of service in n/a

Medium 6.5 Published 4 Aug 2025 Updated 5 Jul 2026

Attackers can cause a denial of service in the poppler library via infinite recursion when processing crafted PDF files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-50420?

CVE-2025-50420 is a medium-severity denial of service vulnerability in Freedesktop Poppler, published on 4 Aug 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS).

Weakness: CWE-674

Which versions are affected by CVE-2025-50420?

It affects 1 product.

Linux distribution packages (26)

`poppler` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	All versions	`22.01.0-150400.3.38.1`
`poppler` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	All versions	`22.01.0-150400.3.38.1`
`poppler` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	All versions	`23.01.0-150500.3.23.1`
`poppler` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	All versions	`23.01.0-150500.3.23.1`
`poppler` SUSE:Linux Enterprise Module for Basesystem 15 SP6	All versions	`24.03.0-150600.3.19.1`
`poppler` SUSE:Linux Enterprise Module for Basesystem 15 SP7	All versions	`24.03.0-150600.3.19.1`
`poppler` SUSE:Linux Enterprise Module for Package Hub 15 SP6	All versions	`24.03.0-150600.3.19.1`
`poppler-qt5` SUSE:Linux Enterprise Module for Package Hub 15 SP6	All versions	`24.03.0-150600.3.19.1`
`poppler-qt6` SUSE:Linux Enterprise Module for Package Hub 15 SP6	All versions	`24.03.0-150600.3.19.1`
`poppler` SUSE:Linux Enterprise Module for Package Hub 15 SP7	All versions	`24.03.0-150600.3.19.1`
`poppler-qt5` SUSE:Linux Enterprise Module for Package Hub 15 SP7	All versions	`24.03.0-150600.3.19.1`
`poppler-qt6` SUSE:Linux Enterprise Module for Package Hub 15 SP7	All versions	`24.03.0-150600.3.19.1`
`poppler` SUSE:Linux Enterprise Server 12 SP5-LTSS	All versions	`0.43.0-16.64.1`
`poppler-qt` SUSE:Linux Enterprise Server 12 SP5-LTSS	All versions	`0.43.0-16.64.1`
`poppler` SUSE:Linux Enterprise Server 15 SP4-LTSS	All versions	`22.01.0-150400.3.38.1`
`poppler` SUSE:Linux Enterprise Server 15 SP5-LTSS	All versions	`23.01.0-150500.3.23.1`
`poppler` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`0.43.0-16.64.1`
`poppler-qt` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`0.43.0-16.64.1`
`poppler` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	All versions	`22.01.0-150400.3.38.1`
`poppler` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	All versions	`23.01.0-150500.3.23.1`
`poppler` SUSE:Manager Proxy LTS 4.3	All versions	`22.01.0-150400.3.38.1`
`poppler` SUSE:Manager Server LTS 4.3	All versions	`22.01.0-150400.3.38.1`
`poppler` openSUSE:Leap 15.6	All versions	`24.03.0-150600.3.19.1`
`poppler-qt5` openSUSE:Leap 15.6	All versions	`24.03.0-150600.3.19.1`
`poppler-qt6` openSUSE:Leap 15.6	All versions	`24.03.0-150600.3.19.1`
`poppler` openSUSE:Tumbleweed	All versions	`25.08.0-1.1`

Products include Freedesktop Poppler.

How do I fix CVE-2025-50420?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-50420 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-50420 exists.

Public exploit code: 1 proofs of concept on GitHub.

All Freedesktop Poppler vulnerabilities

Sources

Also known as CLSA-2026-1783441581, CLSA-2026-1783671750, CLSA-2026-1786352279, DEBIAN-CVE-2025-50420, ECHO-5517-bb69-43be, GHSA-ppc9-vw33-pg6g and 14 more.