CVE-2025-52885 GHSL-2025-042: Poppler has Use-After-Free
A use-after-free vulnerability in Poppler allows attackers to execute arbitrary code or cause denial of service via crafted PDF files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-52885?
CVE-2025-52885 is a medium-severity use after free vulnerability in poppler, published on 10 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.
Weakness: CWE-416
Which versions are affected by CVE-2025-52885?
Linux distribution packages (8)
poppler SUSE:Linux Enterprise Server 16.0 | All versions | 25.04.0-160000.3.1 |
poppler-qt6 SUSE:Linux Enterprise Server 16.0 | All versions | 25.04.0-160000.3.1 |
poppler SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 25.04.0-160000.3.1 |
poppler-qt6 SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 25.04.0-160000.3.1 |
poppler openSUSE:Leap 16.0 | All versions | 25.04.0-160000.3.1 |
poppler-qt5 openSUSE:Leap 16.0 | All versions | 25.04.0-160000.3.1 |
poppler-qt6 openSUSE:Leap 16.0 | All versions | 25.04.0-160000.3.1 |
poppler openSUSE:Tumbleweed | All versions | 25.09.1-2.1 |
How do I fix CVE-2025-52885?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-52885 being exploited?
There is no known exploitation of CVE-2025-52885 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-52885, DEBIAN-CVE-2025-52885, ECHO-7d56-ab20-1ebd, JLSEC-2026-89, MGASA-2025-0251, SUSE-SU-2025:21132-1 and 4 more.