Heap-use-after-free Vulnerability in Poppler Package
Summary
OSV-2026-504: Heap-use-after-free in ObjectStream::getObject. Affects poppler versions >= 1c6e5df94e06c9ad7e5af6aabfe38409532a85de, < b57d9e84660193b922b3ded49f2ab5579198dc13. Fixed in b57d9e84660193b922b3ded49f2ab5579198dc13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Poppler is an open-source PDF rendering library that provides a set of utilities for working with PDF documents. It is widely used in various applications to display and manipulate PDF files. The library is known for its efficiency and compatibility with different PDF standards. However, like many software packages, it can be susceptible to vulnerabilities that may compromise its functionality and security.
Vulnerability Detail
The vulnerability identified in the Poppler package is a heap-use-after-free issue in the ObjectStream::getObject function. This flaw can lead to a crash or potentially allow an attacker to execute arbitrary code. The issue was reported through OSS-Fuzz, highlighting a specific crash state that occurs when the function attempts to access freed memory. This can result in unpredictable behavior and poses a significant risk to applications relying on Poppler for PDF processing.
How To Fix
Minimum fixed version
b57d9e84660193b922b3ded49f2ab5579198dc13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the affected functionality in the Poppler library until the package can be updated. This may involve modifying the application code to bypass calls to ObjectStream::getObject or using alternative libraries for PDF processing.
Conclusion
The heap-use-after-free vulnerability in the Poppler package poses significant risks to applications that rely on it for PDF processing. Users are encouraged to update to the patched version to mitigate these risks and should consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for poppler →
FAQ
A heap-use-after-free vulnerability occurs when a program continues to use memory after it has been freed, potentially leading to crashes or arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The risks include application crashes and the potential for attackers to execute arbitrary code, which can compromise the security of the system.
Yes, a patch is available. Users should update to the fixed version of the Poppler package to mitigate the vulnerability.
You can use tools like Vulert to receive real-time alerts for open-source vulnerabilities in your software, ensuring you are always informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for poppler.
