Moderate Vulnerability in Poppler: Out-of-Bounds Read Issue
Summary
ALSA-2026:0130: Moderate: poppler security update. Affects poppler versions < 20.11.0-13.el8_10. Fixed in 20.11.0-13.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Poppler is a widely used Portable Document Format (PDF) rendering library that enables applications like Evince to display and manipulate PDF files. It is known for its efficiency and compatibility with various PDF standards. However, like many software libraries, Poppler is susceptible to vulnerabilities that can compromise the security and stability of applications relying on it.
Vulnerability Detail
The vulnerability identified as CVE-2025-32365 is an Out-of-Bounds Read issue in the Poppler library. This flaw can potentially allow an attacker to read memory beyond the intended buffer, leading to information disclosure or application crashes. The vulnerability arises from improper handling of certain PDF files, which can be exploited by crafting malicious PDFs that trigger the out-of-bounds read condition.
How To Fix
Minimum fixed version
20.11.0-13.el8_10
This is the first release that contains the fix.
sudo dnf update popplerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening untrusted PDF files that may exploit this vulnerability until the package is updated. It is advisable to implement strict file validation and sanitization processes in applications that utilize Poppler for rendering PDFs.
Conclusion
The Out-of-Bounds Read vulnerability in Poppler poses a moderate risk to applications that utilize this PDF rendering library. It is crucial for users to update their Poppler packages to the latest version to mitigate potential security threats. By following the recommended steps and utilizing tools like Vulert, developers can ensure their applications remain secure.
See every vulnerability recorded for poppler →
FAQ
The vulnerability is an Out-of-Bounds Read issue that can lead to information disclosure or application crashes when processing malicious PDF files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Update the Poppler package to the latest patched version using the command provided in the 'how_to_fix' section.
Yes, avoid opening untrusted PDF files and implement strict validation and sanitization processes in your applications.
Detailed information can be found on the CVE page for CVE-2025-32365, which provides insights into the impact and technical details of the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for poppler.
