Poppler up to 25.9.x PDF File Parser StructTreeRoot use after free

Summaryinfo

A vulnerability was found in Poppler up to 25.9.x. It has been classified as critical. This issue affects the function StructTreeRoot of the component PDF File Parser. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE-2025-52885. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in Poppler up to 25.9.x. This affects the function StructTreeRoot of the component PDF File Parser. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue.

The advisory is shared at securitylab.github.com. This vulnerability is uniquely identified as CVE-2025-52885 since 06/20/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 270703 (Poppler < 25.10.0 Use-After-Free (GHSL-2025-042)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 25.10.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at gitlab.freedesktop.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (270703) and CERT Bund (WID-SEC-2026-1730). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Xerox FreeFlow Print Server

Productinfo

Type

• Document Reader Software

Name

• Poppler

Version

• 25.0
• 25.1
• 25.2
• 25.3
• 25.4
• 25.5
• 25.6
• 25.7
• 25.8
• 25.9

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion