Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 33

Export CSV
CVE-2009-1180

PDF JBIG2 invalid free()

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of invalid data.

CVSS 2.0 · 6.8 Medium EPSS 5.4% KEV · Not listed
Vendors
Apple Foolabs Glyphandcog and 2 more
Products
Cups Xpdf Xpdfreader and 2 more
CVE-2009-1181

PDF JBIG2 NULL dereference

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a NULL pointer dereference.

CVSS 2.0 · 4.3 Medium EPSS 3.8% KEV · Not listed
Vendors
Apple Foolabs Glyphandcog and 2 more
Products
Cups Xpdf Xpdfreader and 2 more
CVE-2009-1182

PDF JBIG2 MMR decoder buffer overflows

Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.

CVSS 2.0 · 7.5 High EPSS 7.3% KEV · Not listed
Vendors
Apple Foolabs Glyphandcog and 2 more
Products
Cups Xpdf Xpdfreader and 2 more
CVE-2009-1183

PDF JBIG2 MMR infinite loop DoS

The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file.

CVSS 2.0 · 4.3 Medium EPSS 3.8% KEV · Not listed
Vendors
Apple Foolabs Glyphandcog and 2 more
Products
Cups Xpdf Xpdfreader and 2 more
CVE-2005-3626

security flaw

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Conectiva Debian Easy Software Products and 15 more
Products
Linux Debian Linux Cups and 30 more
CVE-2005-3624

security flaw

The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.

CVSS 2.0 · 5.0 Medium EPSS 2.3% KEV · Not listed
Vendors
Conectiva Debian Easy Software Products and 15 more
Products
Linux Debian Linux Cups and 30 more
CVE-2005-3625

security flaw

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."

CVSS 2.0 · 10.0 Critical EPSS 3.8% KEV · Not listed
Vendors
Conectiva Debian Easy Software Products and 15 more
Products
Linux Debian Linux Cups and 30 more
CVE-2025-43718

poppler: Poppler stack overflow

Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Poppler
Products
Poppler
CVE-2025-52885

GHSL-2025-042: Poppler has Use-After-Free

Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Poppler
Products
Poppler
CVE-2025-52886

Poppler Use After Free Vulnerability

Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

CVSS 4.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Freedesktop Poppler
Products
Poppler Poppler
CVE-2024-56378

Poppler: out-of-bounds read

libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Freedesktop Poppler
Products
Poppler Poppler
CVE-2010-3703

poppler: use of initialized pointer in PostScriptFunction

The PostScriptFunction::PostScriptFunction function in poppler/Function.cc in the PDF parser in poppler 0.8.7 and possibly other versions up to 0.15.1, and possibly other products, allows context-dependent attackers to cause a denial of service (crash) via a PDF file that triggers an uninitialized pointer dereference.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Poppler Redhat
Products
Poppler Enterprise Linux
CVE-2010-3704

xpdf: array indexing error in FoFiType1::parse()

The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with a crafted PostScript Type1 font that contains a negative array index, which bypasses input validation and triggers memory corruption.

CVSS 2.0 · 6.8 Medium EPSS 3.6% KEV · Not listed
Vendors
Foolabs Glyphandcog Kde and 2 more
Products
Xpdf Xpdfreader Kdegraphics and 2 more