A PostScript calculator function in a PDF divides by INT_MIN and crashes poppler
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
- Advisory
- CVE-2025-32364
- Library
- poppler, poppler on Debian
- Published
- Severity
- 5.5 out of 10, as published
- Affected
- poppler before 25.04.0
- Fixed in
- 25.04.0
- Reaches you
- by opening a file
What triggers it
Rendering a PDF whose Type 4 (PostScript calculator) function stream makes PSStack::roll handle INT_MIN.
What sillybos does
Needs decoding to detect
The flaw is in the pixel data or the compressed stream, which only a decoder can see. Nothing before the decoder can refuse it; updating the decoder is the fix.
The function stream is content that only the renderer evaluates; nothing in the structure pdfinfo reports, or in any header, shows it. Out of a pre-decode check's reach.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade to poppler 25.04.0.
Specifically. Render PDFs in a boxed process with memory and time limits (see Decoding in a box); nothing read before decoding can see this.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2025-32364
- The record entry, triaged 2026-11-03, last checked 2026-11-03