CVE-2025-52886

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
poppler	poppler	< 25.06.0

References

https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203Patch
https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5Patch
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581Exploit, Issue Tracking, Vendor Advisory
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828Product
https://securitylab.github.com/advisories/GHSL-2025-054_poppler/Exploit, Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/07/11/5
http://www.openwall.com/lists/oss-security/2025/07/12/1

Timeline

Published: Jul 2, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-528877.5cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http headers fields are passe CVE-2025-528887.5Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerabilit CVE-2025-528893.4Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 ge CVE-2025-52895.4The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scriptin CVE-2025-528908.1Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13ge CVE-2025-528916.5ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2 CVE-2025-528926.5EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 CVE-2025-528934.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. Ope CVE-2025-528947.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. Ope CVE-2025-528957.5Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially cra CVE-2025-528965.4Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted CVE-2025-528976.1GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious lin