7.1

CVE-2025-32365: freedesktop poppler Out-of-bounds Read

CVSS: 7.1v3.1HighModified
AliasesRHSA-2026:0126RHSA-2026:0128RHSA-2026:0130
Published 05-04-2025Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2025-32365 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in freedesktop poppler. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.3% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
38/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v3.1 (NVD)
EPSS score
0.25%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 8 · Related 5
DLA-4141-1MGASA-2025-0134OPENSUSE-SU-2025:14976-1SUSE-SU-2025:01780-1SUSE-SU-2025:1339-1SUSE-SU-2025:1342-1

Timeline

  1. 05-04-2025
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

0.00 pp

From 0.25% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (gitlab.freedesktop.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat19 products
  • poppler< 0:20.11.0-7.el8_8 | < 0:20.11.0-5.el8_6 | < 0:20.11.0-2.el8_4.2 | < 0:21.01.0-13.el9_0 | < 0:21.01.0-15.el9_2 | < 0:21.01.0-22.el9_6 | < 0:21.01.0-20.el9_4 | < 0:24.02.0-7.el10_0 | < 0:0.66.0-26.el8_2.1 | < 0:21.01.0-23.el9_7 | < 0:24.02.0-7.el10_1 | < 0:20.11.0-13.el8_10
  • poppler-cpp< 0:21.01.0-13.el9_0 | < 0:21.01.0-15.el9_2 | < 0:21.01.0-22.el9_6 | < 0:21.01.0-20.el9_4 | < 0:24.02.0-7.el10_0 | < 0:21.01.0-23.el9_7 | < 0:24.02.0-7.el10_1 | < 0:20.11.0-13.el8_10
  • poppler-cpp-debuginfo< 0:20.11.0-7.el8_8 | < 0:20.11.0-5.el8_6 | < 0:20.11.0-2.el8_4.2 | < 0:21.01.0-13.el9_0 | < 0:21.01.0-15.el9_2 | < 0:21.01.0-22.el9_6 | < 0:21.01.0-20.el9_4 | < 0:24.02.0-7.el10_0 | < 0:0.66.0-26.el8_2.1 | < 0:21.01.0-23.el9_7 | < 0:24.02.0-7.el10_1 | < 0:20.11.0-13.el8_10
  • poppler-cpp-devel< 0:21.01.0-22.el9_6 | < 0:21.01.0-20.el9_4 | < 0:24.02.0-7.el10_0 | < 0:21.01.0-23.el9_7 | < 0:24.02.0-7.el10_1 | < 0:20.11.0-13.el8_10
  • poppler-debuginfo< 0:20.11.0-7.el8_8 | < 0:20.11.0-5.el8_6 | < 0:20.11.0-2.el8_4.2 | < 0:21.01.0-13.el9_0 | < 0:21.01.0-15.el9_2 | < 0:21.01.0-22.el9_6 | < 0:21.01.0-20.el9_4 | < 0:24.02.0-7.el10_0 | < 0:0.66.0-26.el8_2.1 | < 0:21.01.0-23.el9_7 | < 0:24.02.0-7.el10_1 | < 0:20.11.0-13.el8_10
Debian1 product
  • poppler< 22.12.0-2+deb12u1 | < 25.03.0-3
Freedesktop1 product
Ubuntu1 product
  • poppler< 0.41.0-0ubuntu1.16+esm6 | < 0.62.0-2ubuntu2.14+esm5 | < 0.86.1-0ubuntu1.6 | < 22.02.0-2ubuntu0.7 | < 24.02.0-1ubuntu9.3

4 vendors · 22 products

References

35 links
Show all 35 references