Skip to main content

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

Vulnerability IntelligenceCVE-2025-52886

CVE-2025-52886

MEDIUM5.5

Poppler Use After Free Vulnerability

Published Jul 2, 2025

Modified 4 months ago

Details

Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomic_int for reference counting. Because std::atomic_int is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

References

http://www.openwall.com/lists/oss-security/2025/07/11/5

http://www.openwall.com/lists/oss-security/2025/07/12/1

https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203

https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5

https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581

https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828

https://securitylab.github.com/advisories/GHSL-2025-054_poppler/

https://www.cve.org/CVERecord?id=CVE-2025-52886

CVSS Analysis

CVSS v4.0

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

NoneVI:N

Vuln. Availability

HighVA:H

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

5.5/CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Weakness Type (CWE)

Memory Safety

Ecosystems

Timeline

PublishedJul 2, 2025

ModifiedNov 4, 2025

CVE-2025-52886 | Mondoo Vulnerability Intelligence