CVE-2025-43718: Low severity Poppler Poppler vulnerability
Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTSPDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::detail::Executor).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43718?
CVE-2025-43718 is classified as having a moderate severity due to its ability to cause stack consumption leading to a segmentation fault.
How do I fix CVE-2025-43718?
To fix CVE-2025-43718, upgrade to Poppler version 25.04.0 or later to mitigate the vulnerability.
Which versions of Poppler are affected by CVE-2025-43718?
CVE-2025-43718 affects Poppler versions from 24.06.1 up to, but not including, 25.04.0.
What causes the CVE-2025-43718 vulnerability?
CVE-2025-43718 is caused by stack consumption through deeply nested structures in the metadata of a PDF document.
Is CVE-2025-43718 a local or remote vulnerability?
CVE-2025-43718 is typically considered a remote vulnerability as it can be triggered by processing maliciously crafted PDF files.