CVE-2025-52886

Publication date 2 July 2025

Last updated 28 July 2025

Ubuntu priority

Medium

Why this priority?

Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

Read the notes from the security team

Status

Package Ubuntu Release Status
poppler 25.04 plucky
Fixed 25.03.0-3ubuntu1.1
24.10 oracular Ignored end of life, was needs-triage
24.04 LTS noble
Fixed 24.02.0-1ubuntu9.5
22.04 LTS jammy
Fixed 22.02.0-2ubuntu0.9
20.04 LTS focal
Vulnerable
18.04 LTS bionic
Vulnerable
16.04 LTS xenial
Vulnerable

Notes

mdeslaur

There was a major refactoring before the commit below: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1794 https://gitlab.freedesktop.org/poppler/poppler/-/commit/3449a16d3b1389870eb3e20795e802c6ae8bc04f

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
poppler