CVE-2025-52886: GHSL-2025-054: Use After Free (UAF) in Poppler - CVE-2025-52886
Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Because std::atomicint is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.
Other sources
poppler uses std::atomicint for reference counting. Because it is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free.
— GitHub Security Lab
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52886?
CVE-2025-52886 is rated as a high severity vulnerability due to a potential use-after-free condition.
How do I fix CVE-2025-52886?
To fix CVE-2025-52886, update Poppler to version 25.06.0 or later.
What versions of Poppler are affected by CVE-2025-52886?
Poppler versions prior to 25.06.0 are affected by CVE-2025-52886.
What could happen if CVE-2025-52886 is exploited?
Exploitation of CVE-2025-52886 could lead to application crashes or potential code execution due to use-after-free.
Who is the vendor of the software affected by CVE-2025-52886?
The vendor of the affected software is Poppler.